["Repeated GET requests to non-existent paths (e.g., /vwxbi.php, /shellerr.php)","Blocked on 17 DNS blocklists","No web service or other open ports besides SSH"]
{"ai_analysis":{"classification":"scanner|bot","confidence":0.95,"indicators":["Repeated GET requests to non-existent paths (e.g., /vwxbi.php, /shellerr.php)","Blocked on 17 DNS blocklists","No web service or other open ports besides SSH"],"likely_automated":true,"pattern":"The attack pattern involves repeated HTTP GET requests to non-existent paths, which is a common tactic used by automated scanners and bots. The presence of the IP on multiple DNS blocklists further supports this classification.","recommendation":"ban permanently","summary":"The IP 68.221.186.27 is engaged in repeated probing of non-existent paths and has been flagged by multiple DNS blocklists, indicating a high likelihood of automated scanning activity.","threat_level":"high"},"error":null,"geo":{"as":"AS8075 Microsoft Corporation","city":"Madrid","country":"Spain","countryCode":"ES","hosting":true,"isp":"Microsoft Corporation","lat":40.4203,"lon":-3.705774,"mobile":false,"org":"Microsoft Azure Cloud (spaincentral)","proxy":false,"regionName":"Madrid","status":"success","timezone":"Europe/Madrid"},"ip":"68.221.186.27","log_count":63,"webcheck":{"block_lists":{"blocklists":[{"isBlocked":true,"server":"AdGuard","serverIp":"176.103.130.130"},{"isBlocked":true,"server":"AdGuard Family","serverIp":"176.103.130.132"},{"isBlocked":true,"server":"CleanBrowsing Adult","serverIp":"185.228.168.10"},{"isBlocked":true,"server":"CleanBrowsing Family","serverIp":"185.228.168.168"},{"isBlocked":true,"server":"CleanBrowsing Security","serverIp":"185.228.168.9"},{"isBlocked":true,"server":"CloudFlare","serverIp":"1.1.1.1"},{"isBlocked":true,"server":"CloudFlare Family","serverIp":"1.1.1.3"},{"isBlocked":true,"server":"Comodo Secure","serverIp":"8.26.56.26"},{"isBlocked":true,"server":"Google DNS","serverIp":"8.8.8.8"},{"isBlocked":true,"server":"Neustar Family","serverIp":"156.154.70.3"},{"isBlocked":true,"server":"Neustar Protection","serverIp":"156.154.70.2"},{"isBlocked":true,"server":"Norton Family","serverIp":"199.85.126.20"},{"isBlocked":true,"server":"OpenDNS","serverIp":"208.67.222.222"},{"isBlocked":true,"server":"OpenDNS Family","serverIp":"208.67.222.123"},{"isBlocked":true,"server":"Quad9","serverIp":"9.9.9.9"},{"isBlocked":true,"server":"Yandex Family","serverIp":"77.88.8.7"},{"isBlocked":true,"server":"Yandex Safe","serverIp":"77.88.8.88"}]},"dns":{"A":{"address":"68.221.186.27","family":4},"AAAA":[],"CNAME":[],"MX":[],"NS":[],"PTR":[],"SOA":[],"SRV":[],"TXT":[]},"ports":{"failedPorts":[20,21,22,23,25,53,67,68,69,80,110,119,123,143,156,161,162,179,194,389,443,587,993,995,3000,3306,3389,5060,5900,8000,8080,8888],"openPorts":[]},"trace_route":{"message":"Traceroute completed!","result":[{"172.17.0.1":[0.857]},{"192.168.1.1":[0.742]},{"100.64.3.3":[46.635]},{"45.38.16.3":[54.459]},{"85.12.50.76":[55.601]},{"128.241.9.66":[55.377]},{"129.250.3.254":[55.504]},{"129.250.4.31":[54.724]},{"66.198.154.70":[55.413]},{"63.243.138.1":[50.074]},{"104.44.230.174":[59.642]},{"104.44.32.36":[145.874]},false,{"51.10.17.160":[149.764]},{"104.44.19.2":[143.435]},{"51.10.8.109":[143.39]},{"104.44.29.202":[143.236]},{"104.44.49.50":[143.797]},false,false,false,false,false,false,false,false,false,false,false,false]}}}