{"ip":"143.105.152.117","total_events":71,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"33 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["33 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 17,957 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"17,957 bytes sent","bytes_sent":17957,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T22:48:33","last_seen":"2026-09-23T22:49:13","events_24h":0,"events_7d":71,"geo":{"country_code":"CM","country_name":"Cameroon","region":"Centre","city":"Yaoundé","lat":3.8661,"lon":11.5154,"asn":14593,"org":"Space Exploration Technologies Corporation"},"source_domain":"customer.lgosnga1.isp.starlink.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as14593","label":"SpaceX Starlink","category":"isp","url":"https://www.peeringdb.com/asn/14593"},"cve_matches":[{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":71}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq070_00050817_81cd6514","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"b11cuq070_00050817_81cd6514":301,"b11cun050_00040017_976354f0":1281},"akin_families":{"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1282}},"user_agents":["python-requests/2.28.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"],"timeline":[{"date":"2026-09-23","count":71}],"recent_events":[{"timestamp":"2026-09-23T22:49:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpinfo.php","summary":"","payload_hex":"474554202f706870696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"da94f2d0-08c1-4e3e-b24c-76d6c520ff32","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":80},{"timestamp":"2026-09-23T22:49:12","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"3233e19d-b59e-43d5-a160-a3ad6379226e","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":80},{"timestamp":"2026-09-23T22:49:12","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_profiler/phpinfo","summary":"","payload_hex":"474554202f5f70726f66696c65722f706870696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"89a3e7cc-d8af-4fa0-a170-1c1990e4750c","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":80},{"timestamp":"2026-09-23T22:49:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"aa5c47c1-7be9-41c3-b36f-4c0192b21438","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":80},{"timestamp":"2026-09-23T22:49:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/?phpinfo=1","summary":"","payload_hex":"474554202f3f706870696e666f3d3120485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"34cb59d9-22c6-4240-9482-f2a28f7634cd","seq":1,"duration_ms":101,"bytes_in":213,"bytes_out":80},{"timestamp":"2026-09-23T22:49:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.json","summary":"","payload_hex":"474554202f2e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"8f7a2f67-1be5-41af-89da-51e7a0505f20","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":80},{"timestamp":"2026-09-23T22:49:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/frontend_dev.php/$","summary":"","payload_hex":"474554202f66726f6e74656e645f6465762e7068702f2420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"998c8d9d-6769-4166-942c-30223515c072","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":80},{"timestamp":"2026-09-23T22:49:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"069f0797-7e29-4098-9740-ad165ab82d5b","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":80},{"timestamp":"2026-09-23T22:49:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"152ed6cc-f16d-4167-9a66-4c5171abc5f3","seq":1,"duration_ms":100,"bytes_in":207,"bytes_out":80},{"timestamp":"2026-09-23T22:49:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0\"}","body":"0x%5B%5D=androxgh0st","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"504f5354202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a37372e3029204765636b6f2f32303130303130312046697265666f782f37372e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a30782535422535443d616e64726f786768307374","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","ja3":"","session":"87933c6a-a363-4428-b6f1-f3045fb91abf","seq":1,"duration_ms":101,"bytes_in":297,"bytes_out":80}],"http_methods":[{"method":"GET","count":40},{"method":"POST","count":31}],"distinct_ports_total":1,"top_paths":[{"path":"/.env","count":2,"ports":1},{"path":"/cms/.env","count":2,"ports":1},{"path":"/cp/.env","count":2,"ports":1},{"path":"/fedex/.env","count":2,"ports":1},{"path":"/apps/.env","count":2,"ports":1},{"path":"/local/.env","count":2,"ports":1},{"path":"/sources/.env","count":2,"ports":1},{"path":"/.env.project","count":2,"ports":1},{"path":"/laravel/.env","count":2,"ports":1},{"path":"/enviroments/.env","count":2,"ports":1},{"path":"/.env.development","count":2,"ports":1},{"path":"/system/.env","count":2,"ports":1},{"path":"/script/.env","count":2,"ports":1},{"path":"/app/.env","count":2,"ports":1},{"path":"/live_env","count":2,"ports":1}],"distinct_paths_total":40,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"20","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-09-30T16:26:03.423824+00:00"}