{"ip":"45.138.12.51","total_events":178,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"50 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["50 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"21,919 bytes sent","bytes_sent":21919,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T07:23:08","last_seen":"2026-09-19T14:29:32","events_24h":178,"events_7d":178,"geo":{"country_code":"LT","country_name":"Lithuania","region":"","city":"","lat":55.4167,"lon":24.0,"asn":218785,"org":"Tc Datacenter Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":89},{"port":443,"proto":"tcp","label":"HTTPS","count":89}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190900_9dc949149365_e7c285222651"],"tls_ja3":["d6828e30ab66774a91a96ae93be4ae4c"],"ja4h":["ge11nn0300_86b6b04cb9cc","ge11nn0400_9c3956fad5da","ge11nn0100_4740ae6347b0"]},"fingerprint_peers":{"t13i190900_9dc949149365_e7c285222651":1439,"ge11nn0300_86b6b04cb9cc":2240,"ge11nn0400_9c3956fad5da":1544,"ge11nn0100_4740ae6347b0":644},"user_agents":["l9tcpid/v1.1.0","l9explore/1.2.2"],"timeline":[{"date":"2026-09-19","count":178}],"recent_events":[{"timestamp":"2026-09-19T14:29:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sftp-config.json","summary":"","payload_hex":"474554202f736674702d636f6e6669672e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"789799c1-857e-4cbe-801b-09eab6ec7871","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77},{"timestamp":"2026-09-19T14:29:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config/app.php","summary":"","payload_hex":"474554202f636f6e6669672f6170702e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"7b52a7c6-29f5-4e00-af08-51528445a7ac","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":77},{"timestamp":"2026-09-19T14:29:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/public/.env","summary":"","payload_hex":"474554202f7075626c69632f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"f483c313-4996-4a5b-a90d-9312ecc6b210","seq":1,"duration_ms":101,"bytes_in":120,"bytes_out":77},{"timestamp":"2026-09-19T14:29:31","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.dev","summary":"","payload_hex":"474554202f2e656e762e64657620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"11a81ac5-9471-4e82-8b69-4b672715906f","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":77},{"timestamp":"2026-09-19T14:29:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.ci","summary":"","payload_hex":"474554202f2e656e762e636920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"515f6a76-35cb-4fbd-a4f5-774d772e40c5","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":77},{"timestamp":"2026-09-19T14:29:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/_profiler/phpinfo","summary":"","payload_hex":"474554202f5f70726f66696c65722f706870696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"da230018-311a-4575-93cd-0e32b8e0328d","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":77},{"timestamp":"2026-09-19T14:29:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sftp.json","summary":"","payload_hex":"474554202f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"8d52286b-d8f5-48b6-8b24-99c8b83dbad7","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":77},{"timestamp":"2026-09-19T14:29:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.gitlab-ci.yml","summary":"","payload_hex":"474554202f2e6769746c61622d63692e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"7daddb3e-49ef-4762-9f6d-64ea4159a146","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":77},{"timestamp":"2026-09-19T14:29:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.sandbox","summary":"","payload_hex":"474554202f2e656e762e73616e64626f7820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"a7f254ab-d560-4fd5-a435-c2a562f57b3a","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-09-19T14:29:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env_sample","summary":"","payload_hex":"474554202f2e656e765f73616d706c6520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"edbac2c0-a550-4d88-9f64-dea9472e8aab","seq":1,"duration_ms":102,"bytes_in":120,"bytes_out":77}],"http_methods":[{"method":"GET","count":178}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2},{"path":"/backend/.env","count":2,"ports":2},{"path":"/docker-compose.prod.yml","count":2,"ports":2},{"path":"/phpinfo","count":2,"ports":2},{"path":"/.env.ci","count":2,"ports":2},{"path":"/v1/.env","count":2,"ports":2},{"path":"/public/.env","count":2,"ports":2},{"path":"/app/.git/config","count":2,"ports":2},{"path":"/config/app.php","count":2,"ports":2},{"path":"/config/aws.json","count":2,"ports":2},{"path":"/.env.testing","count":2,"ports":2},{"path":"/.svn/wc.db","count":2,"ports":2},{"path":"/laravel/.env","count":2,"ports":2},{"path":"/.env.uat","count":2,"ports":2},{"path":"/.env.preprod","count":2,"ports":2}],"distinct_paths_total":88,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"l9explore/1.2.2","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-09-19T16:08:39.557096+00:00"}