["Repeated HEAD requests to various paths (wp/, backup/, blog/, new/, wordpress/, old/)","No legitimate reason for the IP to be scanning the application","Open only port 22 with no web service detected","Blocked on multiple DNS blocklists"]
{"ai_analysis":{"classification":"scanner","confidence":0.85,"indicators":["Repeated HEAD requests to various paths (wp/, backup/, blog/, new/, wordpress/, old/)","No legitimate reason for the IP to be scanning the application","Open only port 22 with no web service detected","Blocked on multiple DNS blocklists"],"likely_automated":true,"pattern":"The attack pattern involves repeated HEAD requests to different paths, which is a common behavior of automated scanners or bots probing for vulnerabilities.","recommendation":"ban permanently","summary":"The IP address 34.174.158.53 is engaged in repeated probing of non-existent paths, which is a common behavior of automated scanners or bots.","threat_level":"high"},"error":null,"geo":{"error":"HTTPConnectionPool(host='ip-api.com', port=80): Max retries exceeded with url: /json/34.174.158.53?fields=status,country,countryCode,regionName,city,isp,org,as,mobile,proxy,hosting,lat,lon,timezone (Caused by NameResolutionError(\"<urllib3.connection.HTTPConnection object at 0x7f0b1b54a8b0>: Failed to resolve 'ip-api.com' ([Errno -5] No address associated with hostname)\"))"},"ip":"34.174.158.53","log_count":6,"webcheck":{"block_lists":{"blocklists":[{"isBlocked":true,"server":"AdGuard","serverIp":"176.103.130.130"},{"isBlocked":true,"server":"AdGuard Family","serverIp":"176.103.130.132"},{"isBlocked":true,"server":"CleanBrowsing Adult","serverIp":"185.228.168.10"},{"isBlocked":true,"server":"CleanBrowsing Family","serverIp":"185.228.168.168"},{"isBlocked":true,"server":"CleanBrowsing Security","serverIp":"185.228.168.9"},{"isBlocked":true,"server":"CloudFlare","serverIp":"1.1.1.1"},{"isBlocked":true,"server":"CloudFlare Family","serverIp":"1.1.1.3"},{"isBlocked":true,"server":"Comodo Secure","serverIp":"8.26.56.26"},{"isBlocked":true,"server":"Google DNS","serverIp":"8.8.8.8"},{"isBlocked":true,"server":"Neustar Family","serverIp":"156.154.70.3"},{"isBlocked":true,"server":"Neustar Protection","serverIp":"156.154.70.2"},{"isBlocked":true,"server":"Norton Family","serverIp":"199.85.126.20"},{"isBlocked":true,"server":"OpenDNS","serverIp":"208.67.222.222"},{"isBlocked":true,"server":"OpenDNS Family","serverIp":"208.67.222.123"},{"isBlocked":true,"server":"Quad9","serverIp":"9.9.9.9"},{"isBlocked":true,"server":"Yandex Family","serverIp":"77.88.8.7"},{"isBlocked":true,"server":"Yandex Safe","serverIp":"77.88.8.88"}]},"dns":{"A":{"address":"34.174.158.53","family":4},"AAAA":[],"CNAME":[],"MX":[],"NS":[],"PTR":[],"SOA":[],"SRV":[],"TXT":[]},"ports":{"failedPorts":[20,21,23,25,53,67,68,69,80,110,119,123,143,156,161,162,179,194,389,443,587,993,995,3000,3306,3389,5060,5900,8000,8080,8888],"openPorts":[22]},"trace_route":{"message":"Traceroute completed!","result":[{"172.17.0.1":[1.093]},{"192.168.1.1":[0.958]},{"100.64.3.3":[55.252]},{"45.38.16.2":[55.191]},{"85.12.50.80":[55.127]},{"128.241.9.66":[65.706]},{"129.250.5.6":[55.03]},{"129.250.5.45":[54.961]},{"66.198.154.70":[54.903]},false,{"209.85.173.0":[54.758]},false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false]}}}