["Multiple 404 Hits on Common Paths","Exploit Scans for .env, .git/config, config.json files","Use of l9scan User Agent","Probing Non-Existent Paths Repeatedly"]
{"ai_analysis":{"classification":"scanner|bot","confidence":0.85,"indicators":["Multiple 404 Hits on Common Paths","Exploit Scans for .env, .git/config, config.json files","Use of l9scan User Agent","Probing Non-Existent Paths Repeatedly"],"likely_automated":true,"pattern":"The attack pattern involves repeated HTTP GET and POST requests to common paths, including potential configuration files, which are characteristic of automated scanning tools.","recommendation":"ban permanently","summary":"The IP address 159.89.174.87 is exhibiting behavior consistent with a scanner or bot, probing common and potentially exploitable paths on the web application.","threat_level":"high"},"error":null,"geo":{"as":"AS14061 DigitalOcean, LLC","city":"Bengaluru","country":"India","countryCode":"IN","hosting":true,"isp":"DigitalOcean, LLC","lat":12.9753,"lon":77.591,"mobile":false,"org":"DigitalOcean, LLC","proxy":true,"regionName":"Karnataka","status":"success","timezone":"Asia/Kolkata"},"ip":"159.89.174.87","log_count":17,"webcheck":{"block_lists":{"blocklists":[{"isBlocked":true,"server":"AdGuard","serverIp":"176.103.130.130"},{"isBlocked":true,"server":"AdGuard Family","serverIp":"176.103.130.132"},{"isBlocked":true,"server":"CleanBrowsing Adult","serverIp":"185.228.168.10"},{"isBlocked":true,"server":"CleanBrowsing Family","serverIp":"185.228.168.168"},{"isBlocked":true,"server":"CleanBrowsing Security","serverIp":"185.228.168.9"},{"isBlocked":true,"server":"CloudFlare","serverIp":"1.1.1.1"},{"isBlocked":true,"server":"CloudFlare Family","serverIp":"1.1.1.3"},{"isBlocked":true,"server":"Comodo Secure","serverIp":"8.26.56.26"},{"isBlocked":true,"server":"Google DNS","serverIp":"8.8.8.8"},{"isBlocked":true,"server":"Neustar Family","serverIp":"156.154.70.3"},{"isBlocked":true,"server":"Neustar Protection","serverIp":"156.154.70.2"},{"isBlocked":true,"server":"Norton Family","serverIp":"199.85.126.20"},{"isBlocked":true,"server":"OpenDNS","serverIp":"208.67.222.222"},{"isBlocked":true,"server":"OpenDNS Family","serverIp":"208.67.222.123"},{"isBlocked":true,"server":"Quad9","serverIp":"9.9.9.9"},{"isBlocked":true,"server":"Yandex Family","serverIp":"77.88.8.7"},{"isBlocked":true,"server":"Yandex Safe","serverIp":"77.88.8.88"}]},"dns":{"A":{"address":"159.89.174.87","family":4},"AAAA":[],"CNAME":[],"MX":[],"NS":[],"PTR":[],"SOA":[],"SRV":[],"TXT":[]},"ports":{"failedPorts":[20,21,23,25,53,67,68,69,110,119,123,143,156,161,162,179,194,389,443,587,993,995,3000,3306,3389,5060,5900,8000,8080,8888],"openPorts":[22,80]},"trace_route":{"message":"Traceroute completed!","result":[{"172.17.0.1":[0.027]},{"192.168.1.1":[0.547]},{"100.64.3.3":[56.286]},{"45.38.16.2":[46.612]},{"85.12.50.80":[56.587]},{"128.241.9.66":[56.718]},{"129.250.5.6":[57.136]},{"129.250.4.31":[46.69]},{"66.198.154.70":[57.109]},false,{"64.86.143.118":[53.337]},{"66.198.70.10":[312.662]},false,{"115.111.223.34":[305.747]},{"143.244.224.250":[315.163]},false,false,{"159.89.174.87":[311.347]}]}}}