{"ip":"20.58.177.98","total_events":268,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"96 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["96 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"529,332 bytes sent","bytes_sent":529332,"session_seconds":23,"persistent":false}},"first_seen":"2026-09-26T03:20:13","last_seen":"2026-09-28T11:15:21","events_24h":80,"events_7d":268,"geo":{"country_code":"AU","country_name":"Australia","region":"New South Wales","city":"Sydney","lat":-33.8672,"lon":151.1997,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":268}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun010_00000008_c4b2c4aa"]},"fingerprint_peers":{"a11cun010_00000008_c4b2c4aa":494},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-26","count":64},{"date":"2026-09-27","count":124},{"date":"2026-09-28","count":80}],"recent_events":[{"timestamp":"2026-09-28T11:15:21","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/xhikrpkj.php","summary":"","payload_hex":"474554202f7868696b72706b6a2e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":80,"duration_ms":22866,"bytes_in":4835,"bytes_out":6160},{"timestamp":"2026-09-28T11:15:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/82.php","summary":"","payload_hex":"474554202f38322e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":79,"duration_ms":22577,"bytes_in":4773,"bytes_out":6083},{"timestamp":"2026-09-28T11:15:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/bala.php","summary":"","payload_hex":"474554202f62616c612e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":77,"duration_ms":22002,"bytes_in":4660,"bytes_out":5929},{"timestamp":"2026-09-28T11:15:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/x7.php","summary":"","payload_hex":"474554202f78372e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":76,"duration_ms":21714,"bytes_in":4602,"bytes_out":5852},{"timestamp":"2026-09-28T11:15:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/c99.php","summary":"","payload_hex":"474554202f6339392e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":78,"duration_ms":22290,"bytes_in":4717,"bytes_out":6006},{"timestamp":"2026-09-28T11:15:19","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/admin.php/5qybnNMSsoQ.php","summary":"","payload_hex":"474554202f61646d696e2e7068702f357179626e4e4d53736f512e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":73,"duration_ms":20851,"bytes_in":4413,"bytes_out":5621},{"timestamp":"2026-09-28T11:15:19","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/gulu.php","summary":"","payload_hex":"474554202f67756c752e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":75,"duration_ms":21426,"bytes_in":4546,"bytes_out":5775},{"timestamp":"2026-09-28T11:15:19","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/admin.php/fgGb9Rpoi4z.php","summary":"","payload_hex":"474554202f61646d696e2e7068702f666747623952706f69347a2e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":74,"duration_ms":21138,"bytes_in":4488,"bytes_out":5698},{"timestamp":"2026-09-28T11:15:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/amhwdtti.php","summary":"","payload_hex":"474554202f616d6877647474692e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":70,"duration_ms":19988,"bytes_in":4207,"bytes_out":5390},{"timestamp":"2026-09-28T11:15:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cdc.php","summary":"","payload_hex":"474554202f6364632e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"15efe5b8-1ddb-4674-8106-16207fb0291e","seq":69,"duration_ms":19700,"bytes_in":4145,"bytes_out":5313}],"http_methods":[{"method":"GET","count":268}],"distinct_ports_total":1,"top_paths":[{"path":"//av.php","count":4,"ports":1},{"path":"/radio.php","count":4,"ports":1},{"path":"/mac.php","count":4,"ports":1},{"path":"/b8.php","count":4,"ports":1},{"path":"/bro.php","count":4,"ports":1},{"path":"/ops.php","count":4,"ports":1},{"path":"/wp-content/plugins/hellopress/wp_filemanager.php","count":4,"ports":1},{"path":"/this_is_a_new_hello_world.php","count":4,"ports":1},{"path":"/wp_blog_footer.php","count":4,"ports":1},{"path":"/xex.php","count":4,"ports":1},{"path":"/adminfuns.php","count":4,"ports":1},{"path":"/blacks.php","count":4,"ports":1},{"path":"/ab.php","count":4,"ports":1},{"path":"/01.php","count":4,"ports":1},{"path":"/chosen.php","count":4,"ports":1}],"distinct_paths_total":96,"top_snis":[],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":80},{"value":"chicago.vpnigo.de","count":71},{"value":"vpn.chicago.vpnigo.de","count":64},{"value":"nl1.princhub.com","count":53}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-29T08:37:47.044659+00:00"}