{"ip":"81.171.74.60","total_events":47,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9 exploit-path hits","confidence":"high","network_type":"CDN","why":["9 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 32,758 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,758 bytes sent","bytes_sent":32758,"session_seconds":6,"persistent":false}},"first_seen":"2026-10-10T05:58:46","last_seen":"2026-10-10T05:58:54","events_24h":0,"events_7d":47,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Covent Garden","lat":51.5081,"lon":-0.1278,"asn":34343,"org":"Eweka Internet Services B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as34343","label":"Eweka Internet Services","category":"cdn","url":"https://www.peeringdb.com/asn/34343"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":47}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d141000_cbb2034c60b8_e7c285222651"],"tls_client_hello":"1603010102010000fe0303a6feb146247d50402cee3dfac9f40a1e8430f39fa51eb683aa6eafe194d50aa62092ad53d55533c7a4bfe8877cc665cb9d24eee16b86a9c4bdb742ed7a121d09f7001cc02bc02fc02cc030cca9cca8c009c013c00ac014c012130113021303010000990000001a001800001576706e2e6368696361676f2e76706e69676f2e6465000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d002069aab7cde70e163d1d877f9a4ebdab4e62808cfda320e3081816ace1747c3f00","tls_ja3":["88476a293aeb6f5dc7a3630d391c2980"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun020_00040010_724c10fb","b11cuq040_00040812_cfad16f7"]},"fingerprint_peers":{"t13d141000_cbb2034c60b8_e7c285222651":22,"b11cun030_00040012_13ee3d34":4959,"b11cun020_00040010_724c10fb":1555,"b11cuq040_00040812_cfad16f7":23},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":3,"ips":1555}},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-10-10","count":47}],"recent_events":[{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/database.sql","summary":"","payload_hex":"474554202f64617461626173652e73716c20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"daaeee66-54f9-4369-9a02-0d1aae8d7afb","seq":11,"duration_ms":5958,"bytes_in":1381,"bytes_out":847},{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/zzcanary-78a792d0dcc57b8e.xml","summary":"","payload_hex":"474554202f7a7a63616e6172792d373861373932643064636335376238652e786d6c20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"1a3ec361-1a7d-4857-9cfc-25560fa4195c","seq":11,"duration_ms":5945,"bytes_in":1366,"bytes_out":847},{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/dump.sql","summary":"","payload_hex":"474554202f64756d702e73716c20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"ea3112e3-3e2a-45ae-919a-898019e218ca","seq":11,"duration_ms":5939,"bytes_in":1320,"bytes_out":847},{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/backup.sql","summary":"","payload_hex":"474554202f6261636b75702e73716c20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"cf8c0945-73b9-4b31-b093-1b998870087e","seq":11,"duration_ms":5930,"bytes_in":1290,"bytes_out":847},{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/zzcanary-7139dbd15d64f7c3","summary":"","payload_hex":"474554202f6163747561746f722f7a7a63616e6172792d3731333964626431356436346637633320485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"daaeee66-54f9-4369-9a02-0d1aae8d7afb","seq":10,"duration_ms":5360,"bytes_in":1267,"bytes_out":770},{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.xml","summary":"","payload_hex":"474554202f636f6e6669672e786d6c20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"1a3ec361-1a7d-4857-9cfc-25560fa4195c","seq":10,"duration_ms":5347,"bytes_in":1235,"bytes_out":770},{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/backup.tar.gz","summary":"","payload_hex":"474554202f6261636b75702e7461722e677a20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"cf8c0945-73b9-4b31-b093-1b998870087e","seq":10,"duration_ms":5332,"bytes_in":1178,"bytes_out":770},{"timestamp":"2026-10-10T05:58:54","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.php","summary":"","payload_hex":"474554202f636f6e6669672e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"ea3112e3-3e2a-45ae-919a-898019e218ca","seq":10,"duration_ms":5342,"bytes_in":1210,"bytes_out":770},{"timestamp":"2026-10-10T05:58:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/zzcanary-262487569f7d38f5.sql","summary":"","payload_hex":"474554202f7a7a63616e6172792d323632343837353639663764333866352e73716c20485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"1a3ec361-1a7d-4857-9cfc-25560fa4195c","seq":8,"duration_ms":4173,"bytes_in":1006,"bytes_out":616},{"timestamp":"2026-10-10T05:58:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"vpn.chicago.vpnigo.de\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-config.php","summary":"","payload_hex":"474554202f77702d636f6e6669672e70687020485454502f312e310d0a486f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"88476a293aeb6f5dc7a3630d391c2980","session":"daaeee66-54f9-4369-9a02-0d1aae8d7afb","seq":8,"duration_ms":4182,"bytes_in":1012,"bytes_out":616}],"http_methods":[{"method":"GET","count":45},{"method":"HEAD","count":1},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":3,"ports":1},{"path":"/actuator/heapdump","count":1,"ports":1},{"path":"/storage/logs/laravel.log","count":1,"ports":1},{"path":"/backup.sql","count":1,"ports":1},{"path":"/backup.tar.gz","count":1,"ports":1},{"path":"/.bash_history","count":1,"ports":1},{"path":"/secrets.json","count":1,"ports":1},{"path":"/.svn/wc.db","count":1,"ports":1},{"path":"/.ssh/id_ed25519","count":1,"ports":1},{"path":"/phpinfo.php","count":1,"ports":1},{"path":"/backup.zip","count":1,"ports":1},{"path":"/database.sql","count":1,"ports":1},{"path":"/.npmrc","count":1,"ports":1},{"path":"/api/.env","count":1,"ports":1},{"path":"/dump.sql","count":1,"ports":1}],"distinct_paths_total":45,"top_snis":[{"value":"vpn.chicago.vpnigo.de","count":47}],"top_hosts":[{"value":"vpn.chicago.vpnigo.de","count":47}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"vpn.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-13T22:16:56.898579+00:00"}