{"ip":"43.156.111.207","total_events":196,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"64 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["64 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range.","Held a session open for 172s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"1,029,590 bytes sent, longest session 172s","bytes_sent":1029590,"session_seconds":172,"persistent":true}},"first_seen":"2026-08-28T01:09:13","last_seen":"2026-08-28T01:14:03","events_24h":0,"events_7d":0,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.2872,"lon":103.8507,"asn":132203,"org":"Tencent Building, Kejizhongyi Avenue"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as132203","label":"Tencent Global","category":"cdn","url":"https://www.peeringdb.com/asn/132203"},"cve_matches":[{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":196}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h2_f57a46bbacb6_e7c285222651"],"tls_ja3":["faa162b5a653756fba26803ea81b362f"],"ja4h":["ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t13i1310h2_f57a46bbacb6_e7c285222651":3,"ge11nn0300_0db47b7d240d":5177},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-08-28","count":196}],"recent_events":[{"timestamp":"2026-08-28T01:14:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/phpinfo.php3","summary":"","payload_hex":"474554202f706870696e666f2e7068703320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":98,"duration_ms":167109,"bytes_in":10488,"bytes_out":7742},{"timestamp":"2026-08-28T01:14:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/info","summary":"","payload_hex":"474554202f696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":97,"duration_ms":165428,"bytes_in":10383,"bytes_out":7663},{"timestamp":"2026-08-28T01:14:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/config/services.php","summary":"","payload_hex":"474554202f636f6e6669672f73657276696365732e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":96,"duration_ms":163696,"bytes_in":10286,"bytes_out":7584},{"timestamp":"2026-08-28T01:13:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/config/queue.php","summary":"","payload_hex":"474554202f636f6e6669672f71756575652e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":95,"duration_ms":161941,"bytes_in":10174,"bytes_out":7505},{"timestamp":"2026-08-28T01:13:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/temp.php","summary":"","payload_hex":"474554202f74656d702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":94,"duration_ms":160235,"bytes_in":10065,"bytes_out":7426},{"timestamp":"2026-08-28T01:13:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/index.php","summary":"","payload_hex":"474554202f696e6465782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":93,"duration_ms":158548,"bytes_in":9964,"bytes_out":7347},{"timestamp":"2026-08-28T01:13:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-config.php","summary":"","payload_hex":"474554202f77702d636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":92,"duration_ms":156808,"bytes_in":9862,"bytes_out":7268},{"timestamp":"2026-08-28T01:13:51","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-config.php.orig","summary":"","payload_hex":"474554202f77702d636f6e6669672e7068702e6f72696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":91,"duration_ms":155062,"bytes_in":9756,"bytes_out":7189},{"timestamp":"2026-08-28T01:13:49","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/config/mail.php","summary":"","payload_hex":"474554202f636f6e6669672f6d61696c2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":90,"duration_ms":153348,"bytes_in":9645,"bytes_out":7110},{"timestamp":"2026-08-28T01:13:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/config/filesystems.php","summary":"","payload_hex":"474554202f636f6e6669672f66696c6573797374656d732e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"faa162b5a653756fba26803ea81b362f","session":"89db4e65-ce44-4807-9d62-17dd4eb09fa9","seq":89,"duration_ms":151662,"bytes_in":9537,"bytes_out":7031}],"http_methods":[{"method":"GET","count":196}],"distinct_ports_total":1,"top_paths":[{"path":"/laravel/.env","count":8,"ports":1},{"path":"/.env","count":2,"ports":1},{"path":"/vendor/laravel/.env","count":2,"ports":1},{"path":"/v1/.env","count":2,"ports":1},{"path":"/env.js","count":2,"ports":1},{"path":"/info","count":2,"ports":1},{"path":"/public/.env","count":2,"ports":1},{"path":"/app/config/.env","count":2,"ports":1},{"path":"/_profiler","count":2,"ports":1},{"path":"/index.php","count":2,"ports":1},{"path":"/config.js","count":2,"ports":1},{"path":"/apps/.env","count":2,"ports":1},{"path":"/.env.staging","count":2,"ports":1},{"path":"/old/.env","count":2,"ports":1},{"path":"/dev/.env","count":2,"ports":1}],"distinct_paths_total":95,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":196}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-09-10T21:21:38.714309+00:00"}