{"ip":"80.94.92.70","total_events":61,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,034 bytes sent","bytes_sent":14034,"session_seconds":1,"persistent":false}},"first_seen":"2026-06-17T23:13:14","last_seen":"2026-08-14T17:22:22","events_24h":5,"events_7d":24,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":47890,"org":"Unmanaged Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":58},{"port":80,"proto":"tcp","label":"HTTP","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["f72589e607f9b36992b6b437ce399f26"],"ja4h":["ge11nn0500_9af7e0472034"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":1503,"ge11nn0500_9af7e0472034":703},"user_agents":["Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/28.0.1469.0 Safari/537.36","Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3890.0 Safari/537.36","iTunes/4.2 (Macintosh; U; PPC Mac OS X 10.2)","Mozilla/5.0 (X11; FreeBSD i386; rv:28.0) Gecko/20100101 Firefox/28.0 SeaMonkey/2.25","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.92 Safari/537.36","Mozilla/5.0 (Linux; Android 4.4.2; LGMS323 Build/KOT49I.MS32310b) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.103 Mobile Safari/537.36","Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; NOKIA; Lumia 635) like Gecko"],"timeline":[{"date":"2026-06-17","count":8},{"date":"2026-06-19","count":9},{"date":"2026-07-25","count":1},{"date":"2026-07-26","count":3},{"date":"2026-07-29","count":4},{"date":"2026-08-04","count":4},{"date":"2026-08-05","count":8},{"date":"2026-08-09","count":3},{"date":"2026-08-10","count":9},{"date":"2026-08-11","count":3},{"date":"2026-08-13","count":4},{"date":"2026-08-14","count":5}],"recent_events":[{"timestamp":"2026-08-14T17:22:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.25 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/index","summary":"","payload_hex":"474554202f2e6769742f696e64657820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e3235205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.25 Safari/537.36","ja3":"f72589e607f9b36992b6b437ce399f26","session":"c950c8bb-dd9d-48ab-a0a8-c258baf46bb2","seq":1,"duration_ms":101,"bytes_in":236,"bytes_out":76},{"timestamp":"2026-08-14T17:16:45","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.102 Safari/537.36 Vivaldi/2.6.1566.44\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/index","summary":"","payload_hex":"474554202f2e6769742f696e64657820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37352e302e333737302e313032205361666172692f3533372e333620566976616c64692f322e362e313536362e34340d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.102 Safari/537.36 Vivaldi/2.6.1566.44","ja3":"f72589e607f9b36992b6b437ce399f26","session":"ebc8c680-7154-4a06-aded-43e11a557e22","seq":1,"duration_ms":101,"bytes_in":262,"bytes_out":76},{"timestamp":"2026-08-14T12:17:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/index","summary":"","payload_hex":"474554202f2e6769742f696e64657820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028416e64726f69643b204c696e75782061726d76376c3b2072763a31302e302e3129204765636b6f2f32303130303130312046697265666f782f31302e302e312046656e6e65632f31302e302e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1","ja3":"f72589e607f9b36992b6b437ce399f26","session":"5fee6c25-047f-4848-ba3e-50ff1297b447","seq":1,"duration_ms":186,"bytes_in":219,"bytes_out":76},{"timestamp":"2026-08-14T12:17:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/index","summary":"","payload_hex":"474554202f2e6769742f696e64657820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028416e64726f69643b204c696e75782061726d76376c3b2072763a31302e302e3129204765636b6f2f32303130303130312046697265666f782f31302e302e312046656e6e65632f31302e302e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1","ja3":"f72589e607f9b36992b6b437ce399f26","session":"5fee6c25-047f-4848-ba3e-50ff1297b447","seq":1,"duration_ms":186,"bytes_in":219,"bytes_out":76},{"timestamp":"2026-08-14T12:17:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/index","summary":"","payload_hex":"474554202f2e6769742f696e64657820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028416e64726f69643b204c696e75782061726d76376c3b2072763a31302e302e3129204765636b6f2f32303130303130312046697265666f782f31302e302e312046656e6e65632f31302e302e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1","ja3":"f72589e607f9b36992b6b437ce399f26","session":"5fee6c25-047f-4848-ba3e-50ff1297b447","seq":1,"duration_ms":186,"bytes_in":219,"bytes_out":76},{"timestamp":"2026-08-13T23:03:23","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"mukewang/7.2.0 (iPhone; iOS 12.3.1; Scale/2.00) webview\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206d756b6577616e672f372e322e3020286950686f6e653b20694f532031322e332e313b205363616c652f322e30302920776562766965770d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mukewang/7.2.0 (iPhone; iOS 12.3.1; Scale/2.00) webview","ja3":"f72589e607f9b36992b6b437ce399f26","session":"39289dfe-9033-4f08-8781-1b74ff879df6","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":76},{"timestamp":"2026-08-13T20:58:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.87 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31335f3629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e3837205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.87 Safari/537.36","ja3":"f72589e607f9b36992b6b437ce399f26","session":"8a765d48-cbbc-4505-b0b6-3c496abc0fd8","seq":1,"duration_ms":167,"bytes_in":248,"bytes_out":76},{"timestamp":"2026-08-13T20:55:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e757820693638363b2072763a322e302e3129204765636b6f2f32303130303130312046697265666f782f342e302e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1","ja3":"f72589e607f9b36992b6b437ce399f26","session":"96c99d79-de9a-4621-84fd-ae46829b8f45","seq":1,"duration_ms":721,"bytes_in":196,"bytes_out":76},{"timestamp":"2026-08-13T18:11:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/4.0 (compatible; MSIE 6.0; j2me) ReqwirelessWeb/3.5\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f342e302028636f6d70617469626c653b204d53494520362e303b206a326d652920526571776972656c6573735765622f332e350d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/4.0 (compatible; MSIE 6.0; j2me) ReqwirelessWeb/3.5","ja3":"f72589e607f9b36992b6b437ce399f26","session":"f10abbd3-aec7-492b-8525-42fbbbf542ad","seq":1,"duration_ms":237,"bytes_in":189,"bytes_out":76},{"timestamp":"2026-08-11T01:47:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"CSSCheck/1.2.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/refs/","summary":"","payload_hex":"474554202f2e6769742f726566732f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20435353436865636b2f312e322e320d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CSSCheck/1.2.2","ja3":"","session":"5daabb2e-9a89-430c-baf5-1677c3e9cb78","seq":1,"duration_ms":101,"bytes_in":141,"bytes_out":76}],"http_methods":[{"method":"GET","count":61}],"distinct_ports_total":2,"top_paths":[{"path":"/.git/config","count":21,"ports":2},{"path":"/.git/index","count":12,"ports":1},{"path":"/.env","count":9,"ports":1},{"path":"/_profiler/phpinfo","count":8,"ports":1},{"path":"/.git/HEAD","count":7,"ports":2},{"path":"/.git/refs/","count":4,"ports":2}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Charset","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Charset","value":"utf-8","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.25 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-08-15T07:00:32.578788+00:00"}