{"ip":"45.148.10.95","total_events":98,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"42 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["42 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"74,387 bytes sent","bytes_sent":74387,"session_seconds":23,"persistent":false}},"first_seen":"2026-08-11T23:04:31","last_seen":"2026-09-20T02:53:25","events_24h":0,"events_7d":94,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":94},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":5000,"proto":"tcp","label":"Web-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_client_hello":"","tls_ja3":["725543c78edf669194c11dc7a039b56e","11a384388ad36777e1a2e121495037fe"],"http_akin":[]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2569,"t13i251000_b78ed14e2fd0_ab7e3b40a677":100},"akin_families":{},"user_agents":["Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","Mozilla/5.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 12_3_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"],"timeline":[{"date":"2026-08-11","count":4},{"date":"2026-09-18","count":93},{"date":"2026-09-20","count":1}],"recent_events":[{"timestamp":"2026-09-20T02:53:25","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"4ec01a12-c53b-4a52-ba2e-53febe1db580","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":77},{"timestamp":"2026-09-18T18:52:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/mailer/.env","summary":"","payload_hex":"474554202f6d61696c65722f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"344dc494-5a85-497b-a77b-e511ee31e1a1","seq":7,"duration_ms":3501,"bytes_in":987,"bytes_out":539},{"timestamp":"2026-09-18T18:52:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/laravel/.env","summary":"","payload_hex":"474554202f6c61726176656c2f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"344dc494-5a85-497b-a77b-e511ee31e1a1","seq":4,"duration_ms":933,"bytes_in":563,"bytes_out":308},{"timestamp":"2026-09-18T18:52:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/laravel/core/.env","summary":"","payload_hex":"474554202f6c61726176656c2f636f72652f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"344dc494-5a85-497b-a77b-e511ee31e1a1","seq":5,"duration_ms":1423,"bytes_in":709,"bytes_out":385},{"timestamp":"2026-09-18T18:52:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/mail/.env","summary":"","payload_hex":"474554202f6d61696c2f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"344dc494-5a85-497b-a77b-e511ee31e1a1","seq":6,"duration_ms":1827,"bytes_in":847,"bytes_out":462},{"timestamp":"2026-09-18T18:52:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/laravel/info.php","summary":"","payload_hex":"474554202f6c61726176656c2f696e666f2e70687020485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"344dc494-5a85-497b-a77b-e511ee31e1a1","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":77},{"timestamp":"2026-09-18T18:52:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/.env","summary":"","payload_hex":"474554202f2e7673636f64652f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"344dc494-5a85-497b-a77b-e511ee31e1a1","seq":2,"duration_ms":419,"bytes_in":286,"bytes_out":154},{"timestamp":"2026-09-18T18:52:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/js/.env","summary":"","payload_hex":"474554202f6a732f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"344dc494-5a85-497b-a77b-e511ee31e1a1","seq":3,"duration_ms":681,"bytes_in":422,"bytes_out":231},{"timestamp":"2026-09-18T18:51:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/lara/phpinfo.php","summary":"","payload_hex":"474554202f6c6172612f706870696e666f2e70687020485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"79472c89-7269-48ec-945c-e9e22f1f053d","seq":2,"duration_ms":2449,"bytes_in":287,"bytes_out":154},{"timestamp":"2026-09-18T18:51:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/website/.env","summary":"","payload_hex":"474554202f776562736974652f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"231433bf-7d9c-497d-a429-f1c2d9044a28","seq":5,"duration_ms":4340,"bytes_in":724,"bytes_out":385}],"http_methods":[{"method":"GET","count":98}],"distinct_ports_total":3,"top_paths":[{"path":"/.git/config","count":6,"ports":2},{"path":"/","count":5,"ports":3},{"path":"/lara/info.php","count":2,"ports":1},{"path":"/_profiler/phpinfo","count":2,"ports":1},{"path":"/aws-secret.yaml","count":2,"ports":1},{"path":"/_profiler/phpinfo/phpinfo.php","count":2,"ports":1},{"path":"/wp-config","count":2,"ports":1},{"path":"/env.backup","count":2,"ports":1},{"path":"/_profiler/phpinfo/info.php","count":2,"ports":1},{"path":"/dev/.env","count":2,"ports":1},{"path":"/env/.env","count":2,"ports":1},{"path":"/js/.env","count":2,"ports":1},{"path":"/phpinfo.php","count":2,"ports":1},{"path":"/new/.env","count":2,"ports":1},{"path":"/new/.env.local","count":2,"ports":1}],"distinct_paths_total":53,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-09-24T12:55:05.299229+00:00"}