{"ip":"94.26.106.175","total_events":62,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"27 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["27 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"208,540 bytes sent","bytes_sent":208540,"session_seconds":6,"persistent":false}},"first_seen":"2026-10-01T14:01:41","last_seen":"2026-10-01T15:51:12","events_24h":0,"events_7d":62,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"udp":null,"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":62}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"b11cun030_00040012_13ee3d34":4802},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"],"timeline":[{"date":"2026-10-01","count":62}],"recent_events":[{"timestamp":"2026-10-01T15:51:12","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config/.env","summary":"","payload_hex":"474554202f636f6e6669672f2e656e7620485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":31,"duration_ms":6116,"bytes_in":6462,"bytes_out":2418},{"timestamp":"2026-10-01T15:51:12","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":30,"duration_ms":5916,"bytes_in":6262,"bytes_out":2340},{"timestamp":"2026-10-01T15:51:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.example","summary":"","payload_hex":"474554202f2e656e762e6578616d706c6520485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":28,"duration_ms":5515,"bytes_in":5853,"bytes_out":2184},{"timestamp":"2026-10-01T15:51:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":27,"duration_ms":5315,"bytes_in":5636,"bytes_out":2106},{"timestamp":"2026-10-01T15:51:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.aws/credentials","summary":"","payload_hex":"474554202f2e6177732f63726564656e7469616c7320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":26,"duration_ms":5115,"bytes_in":5427,"bytes_out":2028},{"timestamp":"2026-10-01T15:51:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/old/phpinfo.php","summary":"","payload_hex":"474554202f6f6c642f706870696e666f2e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":25,"duration_ms":4915,"bytes_in":5222,"bytes_out":1950},{"timestamp":"2026-10-01T15:51:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":29,"duration_ms":5715,"bytes_in":6062,"bytes_out":2262},{"timestamp":"2026-10-01T15:51:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/site/phpinfo.php","summary":"","payload_hex":"474554202f736974652f706870696e666f2e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":24,"duration_ms":4715,"bytes_in":5002,"bytes_out":1872},{"timestamp":"2026-10-01T15:51:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backend/info.php","summary":"","payload_hex":"474554202f6261636b656e642f696e666f2e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":21,"duration_ms":4113,"bytes_in":4368,"bytes_out":1638},{"timestamp":"2026-10-01T15:51:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/phpinfo.php","summary":"","payload_hex":"474554202f6367692d62696e2f706870696e666f2e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39312e302e343437322e313234205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","ja3":"","session":"c3cc4e17-a49a-4ba3-95bb-04ec1add98b7","seq":23,"duration_ms":4514,"bytes_in":4797,"bytes_out":1794}],"http_methods":[{"method":"GET","count":62}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/debug/phpinfo.php","count":2,"ports":1},{"path":"/phpinfo","count":2,"ports":1},{"path":"/i.php","count":2,"ports":1},{"path":"/pi.php","count":2,"ports":1},{"path":"/php.php","count":2,"ports":1},{"path":"/index.php","count":2,"ports":1},{"path":"/phpinfo.php","count":2,"ports":1},{"path":"/.env","count":2,"ports":1},{"path":"/check.php","count":2,"ports":1},{"path":"/.env.local","count":2,"ports":1},{"path":"/.env.example","count":2,"ports":1},{"path":"/php_version.php","count":2,"ports":1},{"path":"/info.php","count":2,"ports":1},{"path":"/.env.backup","count":2,"ports":1}],"distinct_paths_total":31,"top_snis":[],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":31},{"value":"vpn.chicago.vpnigo.de","count":31}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"vpn.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-10-05T22:23:14.028642+00:00"}