{"ip":"52.231.69.245","total_events":85,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"85 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["85 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"196,813 bytes sent","bytes_sent":196813,"session_seconds":27,"persistent":false}},"first_seen":"2026-09-24T13:48:52","last_seen":"2026-09-24T13:49:18","events_24h":85,"events_7d":85,"geo":{"country_code":"KR","country_name":"South Korea","region":"Seoul","city":"Seoul","lat":37.5658,"lon":126.978,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":85}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun010_00000008_c4b2c4aa"]},"fingerprint_peers":{"a11cun010_00000008_c4b2c4aa":401},"akin_families":{"a11cun010_00000008_c4b2c4aa":{"head":"a11cun010_00000008_c4b2c4aa","shapes":2,"ips":401}},"user_agents":[],"timeline":[{"date":"2026-09-24","count":85}],"recent_events":[{"timestamp":"2026-09-24T13:49:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-signup.php","summary":"","payload_hex":"474554202f77702d7369676e75702e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":82,"duration_ms":25941,"bytes_in":4372,"bytes_out":6396},{"timestamp":"2026-09-24T13:49:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/thoms.php","summary":"","payload_hex":"474554202f74686f6d732e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":83,"duration_ms":26219,"bytes_in":4424,"bytes_out":6474},{"timestamp":"2026-09-24T13:49:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/a.php","summary":"","payload_hex":"474554202f612e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":84,"duration_ms":26512,"bytes_in":4472,"bytes_out":6552},{"timestamp":"2026-09-24T13:49:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/b8.php","summary":"","payload_hex":"474554202f62382e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":85,"duration_ms":26791,"bytes_in":4521,"bytes_out":6630},{"timestamp":"2026-09-24T13:49:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/33.php","summary":"","payload_hex":"474554202f33332e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":79,"duration_ms":24902,"bytes_in":4206,"bytes_out":6162},{"timestamp":"2026-09-24T13:49:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/adminner.php","summary":"","payload_hex":"474554202f61646d696e6e65722e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":80,"duration_ms":25194,"bytes_in":4261,"bytes_out":6240},{"timestamp":"2026-09-24T13:49:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-login.php","summary":"","payload_hex":"474554202f77702d6c6f67696e2e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":81,"duration_ms":25643,"bytes_in":4316,"bytes_out":6318},{"timestamp":"2026-09-24T13:49:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/hao.php?p=","summary":"","payload_hex":"474554202f68616f2e7068703f703d20485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":76,"duration_ms":24012,"bytes_in":4050,"bytes_out":5928},{"timestamp":"2026-09-24T13:49:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cae.php","summary":"","payload_hex":"474554202f6361652e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":77,"duration_ms":24287,"bytes_in":4100,"bytes_out":6006},{"timestamp":"2026-09-24T13:49:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"chicago.vpnigo.de","headers":"{\"host\":\"chicago.vpnigo.de\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/yuca_cytgi.php","summary":"","payload_hex":"474554202f797563615f63797467692e70687020485454502f312e310d0a486f73743a206368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"921cb9e6-0644-42c8-a3ae-5c6502756a96","seq":78,"duration_ms":24588,"bytes_in":4157,"bytes_out":6084}],"http_methods":[{"method":"GET","count":85}],"distinct_ports_total":1,"top_paths":[{"path":"/hur.php","count":1,"ports":1},{"path":"/tiny.php?p=","count":1,"ports":1},{"path":"/1.php","count":1,"ports":1},{"path":"/vpn.php","count":1,"ports":1},{"path":"/mac.php","count":1,"ports":1},{"path":"/h2.php","count":1,"ports":1},{"path":"/b8.php","count":1,"ports":1},{"path":"/asw.php","count":1,"ports":1},{"path":"/ops.php","count":1,"ports":1},{"path":"/gf.php","count":1,"ports":1},{"path":"/kgb.php","count":1,"ports":1},{"path":"/ant.php","count":1,"ports":1},{"path":"/fix.php","count":1,"ports":1},{"path":"/ded.php","count":1,"ports":1},{"path":"/mds.php","count":1,"ports":1}],"distinct_paths_total":85,"top_snis":[],"top_hosts":[{"value":"chicago.vpnigo.de","count":85}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"chicago.vpnigo.de","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T19:28:35.213982+00:00"}