{"ip":"20.219.11.16","total_events":341,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"190 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["190 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,195,056 bytes sent","bytes_sent":1195056,"session_seconds":44,"persistent":false}},"first_seen":"2026-09-26T20:15:11","last_seen":"2026-09-28T09:35:17","events_24h":135,"events_7d":341,"geo":{"country_code":"IN","country_name":"India","region":"Maharashtra","city":"Pune","lat":18.5211,"lon":73.8502,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":341}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun010_00000008_c4b2c4aa"]},"fingerprint_peers":{"a11cun010_00000008_c4b2c4aa":494},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-26","count":206},{"date":"2026-09-28","count":135}],"recent_events":[{"timestamp":"2026-09-28T09:35:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ffl.php","summary":"","payload_hex":"474554202f66666c2e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":135,"duration_ms":44145,"bytes_in":8130,"bytes_out":10395},{"timestamp":"2026-09-28T09:35:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/dYYyLL.php","summary":"","payload_hex":"474554202f645959794c4c2e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":134,"duration_ms":43847,"bytes_in":8076,"bytes_out":10318},{"timestamp":"2026-09-28T09:35:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/3tiny.php?p=","summary":"","payload_hex":"474554202f3374696e792e7068703f703d20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":133,"duration_ms":43550,"bytes_in":8019,"bytes_out":10241},{"timestamp":"2026-09-28T09:35:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/groud1.php","summary":"","payload_hex":"474554202f67726f7564312e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":130,"duration_ms":42423,"bytes_in":7834,"bytes_out":10010},{"timestamp":"2026-09-28T09:35:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-filemannger4h.php","summary":"","payload_hex":"474554202f77702d66696c656d616e6e67657234682e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":132,"duration_ms":43130,"bytes_in":7960,"bytes_out":10164},{"timestamp":"2026-09-28T09:35:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-fxxxx.php","summary":"","payload_hex":"474554202f77702d66787878782e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":131,"duration_ms":42786,"bytes_in":7893,"bytes_out":10087},{"timestamp":"2026-09-28T09:35:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cdc.php","summary":"","payload_hex":"474554202f6364632e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":127,"duration_ms":41499,"bytes_in":7667,"bytes_out":9779},{"timestamp":"2026-09-28T09:35:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/see.php","summary":"","payload_hex":"474554202f7365652e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":128,"duration_ms":41815,"bytes_in":7721,"bytes_out":9856},{"timestamp":"2026-09-28T09:35:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/bdiie.php","summary":"","payload_hex":"474554202f62646969652e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":129,"duration_ms":42113,"bytes_in":7777,"bytes_out":9933},{"timestamp":"2026-09-28T09:35:14","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/opsh.php","summary":"","payload_hex":"474554202f6f7073682e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"34e9980b-ea35-44b5-8ce5-59f7e54e0d8d","seq":125,"duration_ms":40811,"bytes_in":7557,"bytes_out":9625}],"http_methods":[{"method":"GET","count":341}],"distinct_ports_total":1,"top_paths":[{"path":"/wp-content/themes/index.php","count":4,"ports":1},{"path":"/222.php","count":4,"ports":1},{"path":"/myglu.php","count":4,"ports":1},{"path":"/dex.php","count":3,"ports":1},{"path":"/this_is_a_new_hello_world.php","count":3,"ports":1},{"path":"/wp-content/uploads/","count":3,"ports":1},{"path":"/w.php","count":3,"ports":1},{"path":"/4PJcpMFsD8B.php","count":3,"ports":1},{"path":"/opsh.php","count":3,"ports":1},{"path":"/wp-content/plugins/hellopress/wp_filemanager.php","count":3,"ports":1},{"path":"/mac.php","count":3,"ports":1},{"path":"/shiny.php","count":3,"ports":1},{"path":"/xyn.php","count":3,"ports":1},{"path":"/goods.php","count":3,"ports":1},{"path":"/b8.php","count":3,"ports":1}],"distinct_paths_total":190,"top_snis":[],"top_hosts":[{"value":"nl1.princhub.com","count":206},{"value":"vpn.chicago.vpnigo.de","count":135}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"vpn.chicago.vpnigo.de","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-29T08:37:48.229218+00:00"}