["Multiple exploit scans targeting .env.production, .env.production.local, .env.prod, .env.staging, and .env.stage paths","Blocked on 17 DNS blocklists including AdGuard, AdGuard Family, CleanBrowsing Adult, etc.","Repeated GET requests to common web paths (pricing, sitemap.xml, index.html, signup, cart, order, payment, account, subscribe)","Use of user agents indicating automated tools (Mozilla/5.0 and curl/8.4.0)"]
{"ai_analysis":{"classification":"scanner|bruteforce","confidence":0.95,"indicators":["Multiple exploit scans targeting .env.production, .env.production.local, .env.prod, .env.staging, and .env.stage paths","Blocked on 17 DNS blocklists including AdGuard, AdGuard Family, CleanBrowsing Adult, etc.","Repeated GET requests to common web paths (pricing, sitemap.xml, index.html, signup, cart, order, payment, account, subscribe)","Use of user agents indicating automated tools (Mozilla/5.0 and curl/8.4.0)"],"likely_automated":true,"pattern":"The IP is likely part of a botnet or automated scanning tool targeting sensitive environment files, which is common in initial reconnaissance stages of cyber attacks.","recommendation":"Ban permanently","summary":"The IP address 185.177.72.50 is conducting multiple exploit scans targeting sensitive environment files and has been blocked on numerous DNS blocklists, indicating a highly suspicious and potentially malicious activity.","threat_level":"critical"},"error":null,"geo":{"as":"AS211590 Bucklog SARL","city":"Vélizy-Villacoublay","country":"France","countryCode":"FR","hosting":false,"isp":"Bucklog SARL","lat":48.7837,"lon":2.20806,"mobile":false,"org":"FBW NETWORKS","proxy":false,"regionName":"Île-de-France","status":"success","timezone":"Europe/Paris"},"ip":"185.177.72.50","log_count":33,"webcheck":{"block_lists":{"blocklists":[{"isBlocked":true,"server":"AdGuard","serverIp":"176.103.130.130"},{"isBlocked":true,"server":"AdGuard Family","serverIp":"176.103.130.132"},{"isBlocked":true,"server":"CleanBrowsing Adult","serverIp":"185.228.168.10"},{"isBlocked":true,"server":"CleanBrowsing Family","serverIp":"185.228.168.168"},{"isBlocked":true,"server":"CleanBrowsing Security","serverIp":"185.228.168.9"},{"isBlocked":true,"server":"CloudFlare","serverIp":"1.1.1.1"},{"isBlocked":true,"server":"CloudFlare Family","serverIp":"1.1.1.3"},{"isBlocked":true,"server":"Comodo Secure","serverIp":"8.26.56.26"},{"isBlocked":true,"server":"Google DNS","serverIp":"8.8.8.8"},{"isBlocked":true,"server":"Neustar Family","serverIp":"156.154.70.3"},{"isBlocked":true,"server":"Neustar Protection","serverIp":"156.154.70.2"},{"isBlocked":true,"server":"Norton Family","serverIp":"199.85.126.20"},{"isBlocked":true,"server":"OpenDNS","serverIp":"208.67.222.222"},{"isBlocked":true,"server":"OpenDNS Family","serverIp":"208.67.222.123"},{"isBlocked":true,"server":"Quad9","serverIp":"9.9.9.9"},{"isBlocked":true,"server":"Yandex Family","serverIp":"77.88.8.7"},{"isBlocked":true,"server":"Yandex Safe","serverIp":"77.88.8.88"}]},"dns":{"A":{"address":"185.177.72.50","family":4},"AAAA":[],"CNAME":[],"MX":[],"NS":[],"PTR":[],"SOA":[],"SRV":[],"TXT":[]},"ports":{"failedPorts":[20,21,23,25,53,67,68,69,80,110,119,123,143,156,161,162,179,194,389,443,587,993,995,3000,3306,3389,5060,5900,8000,8080,8888],"openPorts":[22]},"trace_route":{"message":"Traceroute completed!","result":[{"172.17.0.1":[0.869]},{"192.168.1.1":[0.755]},{"100.64.3.3":[46.835]},{"45.38.16.2":[55.487]},{"85.12.50.76":[46.737]},{"128.241.9.66":[71.362]},{"129.250.9.167":[56.564]},{"195.22.210.91":[133.309]},{"129.250.9.167":[56.472]},{"193.178.0.61":[189]},{"195.22.210.191":[144.511]},{"185.177.72.50":[136.526]}]}}}