DOSSIER · bp-1788019326175265407-9f3a2cgenerated 2026-08-29 04:57:12.041 UTC
tenant · acme-alphanode · sensor-alpha
Attribution
198.51.100.42
Example City, XX · AS64500 Example Hosting (example.net)
TARGETEDthreat score 76/100
Anonymizer verdict
VPNhigh confidence
87%
Anonymizer signal breakdown
TCP/UA OS mismatchweight 0.35SYN suggests Linux; UA claims Chrome/macOS
Hosting ASN heuristicweight 0.32AS64500 is a hosting network, not a consumer ISP
Timezone driftweight 0.14Beacon reported America/Chicago; GeoIP: UTC+3 (9h drift)
WebRTC LAN leakweight 0.06192.168.4.14 (behind proxy)
Session timeline
ΔtVerbPathCodeKind
+000msGET/200landing
+218msGET/.env200config_leak
+412msGET/.git/config200config_leak
+901msGET/wp-login.php200admin_panel
+1.14sGET/actuator/env200actuator
+1.47sGET/actuator/heapdump200actuator
+2.03sPOST/xmlrpc.php200admin_panel
+3.21sGET/phpmyadmin/200admin_panel
+8.87sPOST/vendor/phpunit/phpunit/src/util/php/eval-stdin.php200webshell_probe
+35.88sCLOSE(session close)—close
Wire fingerprint
JA3 hasha0e9f5c3d4b8f1e7a2c9d6b4e8f3a5c1
JA4t13d1516h2_8daaf6152771_e5627efa2ab1
SNIstaging.example.com
ALPNh2, http/1.1
TCP window29200
TTL51 (Linux-shaped)
Payload evidence
POST /xmlrpc.php body
sha256:3f9b2c7a5d1e8f0c4a6b9d2e7c3f1a5b8d0e2c4f6a8b1d3e5c7f9a2b4d6e8f0c
application/xml · Multicall probe for wp.getUsersBlogs — classic WordPress XML-RPC recon.
POST /vendor/phpunit/... body
sha256:8a4c2e6f1b3d7a9c5e0f2b4d6a8c1e3f5b7d9a2c4e6f8b1d3a5c7e9f2b4d6a8c
text/plain · CVE-2017-9841 eval-stdin injection with base64-encoded curl-to-shell payload (see indicators).
Recovered indicators
KindValueTags
ipv4203.0.113.45c2_candidate
ipv4203.0.113.208c2_candidate
urlhxxp://203.0.113.45/x86_64/loader.elfpayload_delivery
domainexfil-pool.example[.]netexfil
telegram_bot7842339152:AAH...REDACTEDc2 · telegram
5 indicators extracted from 2 payloads. All values above defanged for display.
Canary state
4 tokens registered · 0 triggered
A trip fires when one of these values later appears in a different session.
quiet
aws_access_keyAKIAIOSFODNN7EXAMPLE-bp-abc12embedded in /actuator/env
env_varbp_env_af8c9d0e...embedded in /.env
web_beaconhttps://canary.blackpot.io/_bp/canary/bp_bcn_02f1d...embedded in HTML comment on /
Recommended enforcement
Block · single IPnot yet pushed
tier=TARGETED · score=76 · anonymizer.confidence=0.87 · hosting ASN + webshell probe attempted
Cloudflareblock → 198.51.100.42 · POST /accounts/:account/firewall/access_rules/rules
AWS WAFblackpot-alpha-blocks-v4 · BLOCK
iptablesiptables -A INPUT -s 198.51.100.42 -j DROP
Throttle window10m same-ASN burst pending (1 of 3 required)