{"ip":"81.171.72.93","total_events":47,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9 exploit-path hits","confidence":"high","network_type":"CDN","why":["9 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 33,850 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"33,850 bytes sent","bytes_sent":33850,"session_seconds":6,"persistent":false}},"first_seen":"2026-10-09T15:03:45","last_seen":"2026-10-09T15:03:53","events_24h":0,"events_7d":47,"geo":{"country_code":"DE","country_name":"Germany","region":"State of Berlin","city":"Berlin","lat":52.5196,"lon":13.4069,"asn":34343,"org":"Eweka Internet Services B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as34343","label":"Eweka Internet Services","category":"cdn","url":"https://www.peeringdb.com/asn/34343"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":47}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d141000_cbb2034c60b8_e7c285222651"],"tls_client_hello":"16030101050100010103035fe00372d3463c79775ad7f0e22d64f8329cc55e6c15c4894637dafca8b03cc52012ead0e186630f24087e6145a987586ed2c82813ae78ecd24bc6567b633e89af001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100009c0000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d00200a1905d1bac87336af413131e026e493ffebb4f3b6d5aa5021f1ee","tls_ja3":["88476a293aeb6f5dc7a3630d391c2980"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun020_00040010_724c10fb","b11cuq040_00040812_cfad16f7"]},"fingerprint_peers":{"t13d141000_cbb2034c60b8_e7c285222651":22,"b11cun020_00040010_724c10fb":1555,"b11cuq040_00040812_cfad16f7":23,"b11cun030_00040012_13ee3d34":4959},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":3,"ips":1555}},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-10-09","count":47}],"recent_events":[{"timestamp":"2026-10-09T15:03:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/zzcanary-76e4f0bee2d54dbf","summary":"","payload_hex":"474554202f2e6769742f7a7a63616e6172792d3736653466306265653264353464626620485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"4142647e-e826-49d1-91cb-6c12fa437aba","seq":13,"duration_ms":6399,"bytes_in":1624,"bytes_out":1001},{"timestamp":"2026-10-09T15:03:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.bash_history","summary":"","payload_hex":"474554202f2e626173685f686973746f727920485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"a2077636-ad43-4540-981c-7487e8d31c18","seq":12,"duration_ms":5869,"bytes_in":1444,"bytes_out":924},{"timestamp":"2026-10-09T15:03:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"4142647e-e826-49d1-91cb-6c12fa437aba","seq":12,"duration_ms":5862,"bytes_in":1489,"bytes_out":924},{"timestamp":"2026-10-09T15:03:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/_vti_pvt/zzcanary-49548cd7ed2a0a24","summary":"","payload_hex":"474554202f5f7674695f7076742f7a7a63616e6172792d3439353438636437656432613061323420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"70b02715-afa8-47b2-bdee-80a362677eb8","seq":11,"duration_ms":5541,"bytes_in":1414,"bytes_out":847},{"timestamp":"2026-10-09T15:03:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-admin/zzcanary-31f35d00df1b1131.php","summary":"","payload_hex":"474554202f77702d61646d696e2f7a7a63616e6172792d333166333564303064663162313133312e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"ebcb6e8a-6c7b-46f5-9d39-653e55fc2454","seq":8,"duration_ms":4294,"bytes_in":1007,"bytes_out":616},{"timestamp":"2026-10-09T15:03:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.ssh/zzcanary-6c93133be509dfc5","summary":"","payload_hex":"474554202f2e7373682f7a7a63616e6172792d3663393331333362653530396466633520485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"a2077636-ad43-4540-981c-7487e8d31c18","seq":11,"duration_ms":5307,"bytes_in":1326,"bytes_out":847},{"timestamp":"2026-10-09T15:03:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.ssh/id_rsa","summary":"","payload_hex":"474554202f2e7373682f69645f72736120485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"4142647e-e826-49d1-91cb-6c12fa437aba","seq":11,"duration_ms":5289,"bytes_in":1375,"bytes_out":847},{"timestamp":"2026-10-09T15:03:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-admin/setup-config.php","summary":"","payload_hex":"474554202f77702d61646d696e2f73657475702d636f6e6669672e70687020485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"ebcb6e8a-6c7b-46f5-9d39-653e55fc2454","seq":7,"duration_ms":3703,"bytes_in":864,"bytes_out":539},{"timestamp":"2026-10-09T15:03:52","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/_vti_pvt/service.pwd","summary":"","payload_hex":"474554202f5f7674695f7076742f736572766963652e70776420485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"70b02715-afa8-47b2-bdee-80a362677eb8","seq":10,"duration_ms":4950,"bytes_in":1275,"bytes_out":770},{"timestamp":"2026-10-09T15:03:51","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.xml","summary":"","payload_hex":"474554202f636f6e6669672e786d6c20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"4142647e-e826-49d1-91cb-6c12fa437aba","seq":9,"duration_ms":4112,"bytes_in":1125,"bytes_out":693}],"http_methods":[{"method":"GET","count":45},{"method":"HEAD","count":1},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":3,"ports":1},{"path":"/actuator/heapdump","count":1,"ports":1},{"path":"/zzcanary-309add0324f95b1d.json","count":1,"ports":1},{"path":"/backup.sql","count":1,"ports":1},{"path":"/backup.tar.gz","count":1,"ports":1},{"path":"/.bash_history","count":1,"ports":1},{"path":"/secrets.json","count":1,"ports":1},{"path":"/.svn/wc.db","count":1,"ports":1},{"path":"/.ssh/id_ed25519","count":1,"ports":1},{"path":"/phpinfo.php","count":1,"ports":1},{"path":"/backup.zip","count":1,"ports":1},{"path":"/database.sql","count":1,"ports":1},{"path":"/.npmrc","count":1,"ports":1},{"path":"/api/.env","count":1,"ports":1},{"path":"/dump.sql","count":1,"ports":1}],"distinct_paths_total":45,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":47}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":47}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-13T22:12:59.450790+00:00"}