{"ip":"20.28.180.172","total_events":414,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"200 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["200 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range.","Held a session open for 69s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"1,925,782 bytes sent, longest session 69s","bytes_sent":1925782,"session_seconds":69,"persistent":true}},"first_seen":"2026-09-29T09:45:34","last_seen":"2026-10-01T11:53:00","events_24h":199,"events_7d":414,"geo":{"country_code":"AU","country_name":"Australia","region":"New South Wales","city":"Sydney","lat":-33.8672,"lon":151.1997,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":414}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun010_00040000_c4b2c4aa"]},"fingerprint_peers":{"b11cun010_00040000_c4b2c4aa":655},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-29","count":215},{"date":"2026-10-01","count":199}],"recent_events":[{"timestamp":"2026-10-01T11:53:00","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-inic3.php","summary":"","payload_hex":"474554202f77702d696e6963332e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":199,"duration_ms":69173,"bytes_in":10557,"bytes_out":15522},{"timestamp":"2026-10-01T11:52:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-signup.php","summary":"","payload_hex":"474554202f77702d7369676e75702e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":197,"duration_ms":68594,"bytes_in":10446,"bytes_out":15366},{"timestamp":"2026-10-01T11:52:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-block.php","summary":"","payload_hex":"474554202f77702d626c6f636b2e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":196,"duration_ms":68254,"bytes_in":10390,"bytes_out":15288},{"timestamp":"2026-10-01T11:52:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-xmlsia.php","summary":"","payload_hex":"474554202f77702d786d6c7369612e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":198,"duration_ms":68883,"bytes_in":10502,"bytes_out":15444},{"timestamp":"2026-10-01T11:52:58","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-class-api.php","summary":"","payload_hex":"474554202f77702d636c6173732d6170692e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":194,"duration_ms":67461,"bytes_in":10275,"bytes_out":15132},{"timestamp":"2026-10-01T11:52:58","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-class-atom.php","summary":"","payload_hex":"474554202f77702d636c6173732d61746f6d2e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":195,"duration_ms":67749,"bytes_in":10335,"bytes_out":15210},{"timestamp":"2026-10-01T11:52:58","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-links-opml.php","summary":"","payload_hex":"474554202f77702d6c696e6b732d6f706d6c2e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":193,"duration_ms":67174,"bytes_in":10216,"bytes_out":15054},{"timestamp":"2026-10-01T11:52:57","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/class-t.api.php","summary":"","payload_hex":"474554202f636c6173732d742e6170692e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":192,"duration_ms":66875,"bytes_in":10156,"bytes_out":14976},{"timestamp":"2026-10-01T11:52:57","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/plugin-install.php","summary":"","payload_hex":"474554202f706c7567696e2d696e7374616c6c2e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":190,"duration_ms":66300,"bytes_in":10044,"bytes_out":14820},{"timestamp":"2026-10-01T11:52:57","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/plugin-editor.php","summary":"","payload_hex":"474554202f706c7567696e2d656469746f722e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c0d7032f-a030-470b-ab24-1fc3983724ef","seq":189,"duration_ms":66012,"bytes_in":9983,"bytes_out":14742}],"http_methods":[{"method":"GET","count":414}],"distinct_ports_total":1,"top_paths":[{"path":"/this_is_a_new_hello_world.php","count":3,"ports":1},{"path":"/wp-content/plugins/hellopress/wp_filemanager.php","count":3,"ports":1},{"path":"/8573.php","count":2,"ports":1},{"path":"//rip.php","count":2,"ports":1},{"path":"/a4.php","count":2,"ports":1},{"path":"/ms-edit.php","count":2,"ports":1},{"path":"/class-t.api.php","count":2,"ports":1},{"path":"/ioxi001.PhP7","count":2,"ports":1},{"path":"/ws60.php","count":2,"ports":1},{"path":"/init.php","count":2,"ports":1},{"path":"/mini.php","count":2,"ports":1},{"path":"/ws61.php","count":2,"ports":1},{"path":"/media.php","count":2,"ports":1},{"path":"/CDX1.php","count":2,"ports":1},{"path":"/admin/index.php","count":2,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[{"value":"chicago.vpnigo.de","count":199},{"value":"pihole.chicago.vpnigo.de","count":150},{"value":"vpn.chicago.vpnigo.de","count":65}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"chicago.vpnigo.de","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-01T13:46:19.737029+00:00"}