{"ip":"77.90.185.244","observed":true,"total_events":5614,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 interactive session(s) carried an exploit attempt","confidence":"high","network_type":null,"why":["4 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","The first-packet sensors recorded 5,614 event(s) from this address as well.","Not in any known-scanner range.","Sent 92,175,512 bytes: sustained payload delivery, not a single opportunistic request.","Held a session open for 95s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"92,175,512 bytes sent, longest session 95s","bytes_sent":92175512,"session_seconds":95,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-13T22:24:45","last_seen":"2026-10-15T00:20:10","events_24h":4191,"events_7d":5614,"interactive_sessions":501,"interactive_sessions_24h":501,"interactive_sessions_7d":501,"interactive_protocols":[{"protocol":"http","sessions":435},{"protocol":"tls","sessions":51}],"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":213790,"org":"Limited Network LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":501,"first_seen":"2026-10-14T17:51:12","last_seen":"2026-10-15T00:20:10","verdicts":[{"verdict":"scan","sessions":431},{"verdict":"unknown","sessions":66},{"verdict":"exploit-attempt","sessions":4}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":435}],"services":[{"protocol":"http","port":5173,"sessions":278},{"protocol":"http","port":2375,"sessions":157},{"protocol":"tls","port":2375,"sessions":27},{"protocol":"tls","port":5173,"sessions":24},{"protocol":"tcp","port":81,"sessions":5},{"protocol":"tcp","port":5001,"sessions":3},{"protocol":"tcp","port":51005,"sessions":3},{"protocol":"tcp","port":2375,"sessions":2},{"protocol":"tcp","port":5173,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[]},"top_ports":[{"port":5173,"proto":"tcp","label":"","count":1016,"sessions":304},{"port":2375,"proto":"tcp","label":"Docker","count":1016,"sessions":186},{"port":8007,"proto":"tcp","label":"","count":1016,"sessions":0},{"port":6070,"proto":"tcp","label":"","count":1016,"sessions":0},{"port":3001,"proto":"tcp","label":"","count":915,"sessions":0},{"port":2222,"proto":"tcp","label":"SSH-alt","count":635,"sessions":0},{"port":81,"proto":"tcp","label":"","count":0,"sessions":5},{"port":5001,"proto":"tcp","label":"","count":0,"sessions":3},{"port":51005,"proto":"tcp","label":"","count":0,"sessions":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105d8010005d40303174410af033196173c04e70ed4466e7f8c26a8e1548e7b803ebfcc70b43ca6f520521044b032724083dc512c81fe9224e2e733646b2e083d15502f67d9be79c680001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000571000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c0675377bcfc2e52697738e8a5d27bc7e358cff64b4e85774c01072c28166bb204034a0340fa37268f739d71731cab827527c856f0a99cfb5c31e9976661da3239bc8d09563fb428a1ef89033da112f7b7c8fcfa1e9b195a77c75370f79eb8b4953795cdad94aeed2a06327672a515c8c8b734fba2ad7f009ab376ce8c393e67bc1d78b4771ff04828cc2e4be9635d225a5ccaa601c571ba8b73a344145502c83e135840159172c105e48c94589782a038274e90c557366ca4040b5ac6070cd904d2fa9e30e0c97a71736c9252eb472578508448c4b5c240ce2b61ba934abbf9802c206b91fbfc0798ca00bfbc94152c7948606764201225464626608cfd3c2677b9c3df185faff728b9a4ce18d668e111c7e84304cf673417a163af72599f335a27445da916c3b4752e35895948691f2a481e4dc4ce6c0baee67b061c7c255fcb93fde243dd179305baba01dc05c0d40de2e52eac44a095ccc5c5940a975718eb63059b87a79a853aae536d4c18778e5b8a54281e655a007b7c0315ca8f34a08ced85a587064f01f6b481e21e0ad24386a3412254345cb907fc352850db0bfa0512fdc55bf2b843c3851416718737058763a6abda12ae5af11946c694c388cb8c366ff259c5db307aff227edc424af5f5b6f190c393f34bf2562161d92423243b564962bd44c6c534305af2619e1c0ab876be52b85d6b9025e7ac951789081d3915c9421052b4c5a07678a6f3568e806743628a8de93b644c67a4aacbeec3c271838d17201788806d9ce396ba4a65e844a919bb9490ca40f2083d5d751fffd39a354223af1680cb5019bbd08da69bbbc66c823ec9c02aa663b7f7cd12f8bb4ba0587025174cd568d9b14526998aa3079d501725e2eb9c3edc62fe01a9143c838ba674c8fc7c1f04857fbbc91b58382123a055644f4730a41a92647212752a4364e1dcae733ba69987a589f2cad9f4767c854ed46c1c1a3968dd7b9cc821318a74301b843c5b21a402d7a675f7b2a34371ce625fbc233274a66d77e7245744069417c068573490d30efe2acbd3d7936209664132ce2dd865028c389b64b8856926de978416e213b3839e71719633a842b35c11087b7c63d83034c1c91a6c890a01a8b750058e41bbe8d21054c5136c441f2ce96832858b71e129ca89752380a8efc9cfeeb10a72123a9e9543eee401c3fb8baa833d65696d0cc9b67d7cb25636273b53525f6b4c9c9757076292dbc32cc3212e6b3c75182a986ce8859cf49dfdd89811559982339143ac313a23ce67d0a73d4b54d412649dcb57da825abb22c6b8552e66fc81d5ca1d32169affb89676954a8a472d233c8a965882e2bb89062a5ff89a18eaf11383d69fd2d349dd635281c851c7aac072b6ae4749ccdbf04a91545807596c7b5411dd4162b9129e718c3273c8841f626764eb214904b859a5660d9b3d4c284b0222acdfb18acaa879928c13d0b3688d74c02a6227f5c480665bbe4be318b84833d5bc85482669cf79a5c9d20dc743933dc0903e02b93e16bac49581fa46718acbc236a3c5d90b1c9ee54eeb1b019753ba4581acf6707b8f4428a24767c14717e1c214022b2362e6b7bd1016ed1600683823f432c0df36723b397dcf64074006bce84e466e90c2e8b4dc1a524cc1524208b8eeb83a388cc000fda8aebb75c59a73cb605fd8d6eceac0b44ca7def5c02cd7fc85f2df269991f6174e001d0020aebb75c59a73cb605fd8d6eceac0b44ca7def5c02cd7fc85f2df269991f6174e","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4"],"http_akin":["b11cun050_0004003c_a47bb3dc","b11cun060_0004003d_f55b17ef","b11cun060_0004003d_8084a027"]},"fingerprint_peers":{"t13i1311h2_f57a46bbacb6_ab7e3b40a677":30,"b11cun050_0004003c_a47bb3dc":6,"b11cun060_0004003d_f55b17ef":6,"b11cun060_0004003d_8084a027":6},"akin_families":{"b11cun050_0004003c_a47bb3dc":{"head":"b11cun060_0004003d_f55b17ef","shapes":3,"ips":6},"b11cun060_0004003d_f55b17ef":{"head":"b11cun060_0004003d_f55b17ef","shapes":3,"ips":6},"b11cun060_0004003d_8084a027":{"head":"b11cun060_0004003d_f55b17ef","shapes":3,"ips":6}},"user_agents":["Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.18","Mozilla/5.0 (Linux 2.4.18-18.7.x i686; U) Opera 6.03  [en]","Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36 OPR/33.0.1990.58","Mozilla/4.0 (compatible; MSIE8.0; Windows NT 6.0) .NET CLR 2.0.50727)","Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.94 Safari/537.36 OPR/27.0.1689.66 (Edition Campaign 37)","Mozilla/6.0 (Macintosh; I; Intel Mac OS X 11_7_9; de-LI; rv:1.9b4) Gecko/2012010317 Firefox/10.0.1","Mozilla/5.0 (Linux; Android 7.0; SAMSUNG SM-G950F Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/6.4 Chrome/56.0.2924.87 Mobile Safari/537.36","Mozilla/5.0 (Linux; U; Android 4.2.2; tr-tr; Vodafone Smart Tab 4 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.2 Mobile Safari/534.30 SVN/040FTG1"],"timeline":[{"date":"2026-10-13","count":1016,"sessions":0},{"date":"2026-10-14","count":4598,"sessions":498},{"date":"2026-10-15","count":0,"sessions":3}],"recent_events":[{"timestamp":"2026-10-14T23:24:04","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"d8218259-6c86-47b2-9024-2f7b4a6ce722","seq":1,"duration_ms":100,"bytes_in":262,"bytes_out":78},{"timestamp":"2026-10-14T23:24:03","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_static/.env","summary":"","payload_hex":"474554202f5f7374617469632f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"50c987e8-8bc1-4f75-80c3-29d5b688300d","seq":3,"duration_ms":931,"bytes_in":884,"bytes_out":234},{"timestamp":"2026-10-14T23:24:02","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cron/.env","summary":"","payload_hex":"474554202f63726f6e2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"50c987e8-8bc1-4f75-80c3-29d5b688300d","seq":2,"duration_ms":541,"bytes_in":591,"bytes_out":156},{"timestamp":"2026-10-14T23:24:02","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/build/.env","summary":"","payload_hex":"474554202f6275696c642f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"50c987e8-8bc1-4f75-80c3-29d5b688300d","seq":1,"duration_ms":101,"bytes_in":296,"bytes_out":78},{"timestamp":"2026-10-14T23:24:00","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sites/all/libraries/mailchimp/.env","summary":"","payload_hex":"474554202f73697465732f616c6c2f6c69627261726965732f6d61696c6368696d702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"f8629159-8d18-493b-b799-0983cccc23e2","seq":117,"duration_ms":68910,"bytes_in":34894,"bytes_out":9126},{"timestamp":"2026-10-14T23:23:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mail/.env","summary":"","payload_hex":"474554202f6d61696c2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"f8629159-8d18-493b-b799-0983cccc23e2","seq":116,"duration_ms":68421,"bytes_in":34574,"bytes_out":9048},{"timestamp":"2026-10-14T23:23:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/system/.env","summary":"","payload_hex":"474554202f73797374656d2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"f8629159-8d18-493b-b799-0983cccc23e2","seq":115,"duration_ms":67905,"bytes_in":34279,"bytes_out":8970},{"timestamp":"2026-10-14T23:23:58","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/back/.env","summary":"","payload_hex":"474554202f6261636b2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"f8629159-8d18-493b-b799-0983cccc23e2","seq":114,"duration_ms":67429,"bytes_in":33982,"bytes_out":8892},{"timestamp":"2026-10-14T23:23:58","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/base/.env","summary":"","payload_hex":"474554202f626173652f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"f8629159-8d18-493b-b799-0983cccc23e2","seq":113,"duration_ms":66991,"bytes_in":33687,"bytes_out":8814},{"timestamp":"2026-10-14T23:23:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5173\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/project/.env","summary":"","payload_hex":"474554202f70726f6a6563742f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f5320395f305f32206c696b65204d6163204f53205829204170706c655765624b69742f3630302e312e3420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f392e30204d6f62696c65205361666172692f3630302e312e340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","ja3":"","session":"f8629159-8d18-493b-b799-0983cccc23e2","seq":112,"duration_ms":66475,"bytes_in":33392,"bytes_out":8736}],"http_methods":[{"method":"GET","count":5614}],"distinct_ports_total":9,"top_paths":[{"path":"/site.zip","count":90,"ports":6},{"path":"/","count":89,"ports":6},{"path":"/phpinfo.php","count":45,"ports":6},{"path":"/info/","count":45,"ports":6},{"path":"/app_dev.php/_profiler/phpinfo","count":45,"ports":6},{"path":"/../.env","count":45,"ports":6},{"path":"/appsettings.json","count":45,"ports":6},{"path":"/_profiler/phpinfo","count":45,"ports":6},{"path":"/.env.save","count":45,"ports":6},{"path":"/?phpinfo=-1","count":45,"ports":6},{"path":"/.env.production","count":45,"ports":6},{"path":"/backend/.env","count":45,"ports":6},{"path":"/api/.env","count":45,"ports":6},{"path":"/server/.env","count":45,"ports":6},{"path":"/app/.env","count":45,"ports":6}],"distinct_paths_total":169,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":2794}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Language","Connection","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5173","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (iPhone; CPU iPhone OS 9_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/9.0 Mobile Safari/600.1.4","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-10-15T04:29:54.861583+00:00"}