["Multiple exploit scan attempts targeting .env, .env.bak, .env.save, .env.local paths","User agents mimicking Firefox and Chrome browsers","Blocked on 17 DNS blocklists including AdGuard, CleanBrowsing Adult, etc.","Activity from Andorra, a small country with no legitimate reason for scanning the application"]
{"ai_analysis":{"classification":"scanner|bot","confidence":0.95,"indicators":["Multiple exploit scan attempts targeting .env, .env.bak, .env.save, .env.local paths","User agents mimicking Firefox and Chrome browsers","Blocked on 17 DNS blocklists including AdGuard, CleanBrowsing Adult, etc.","Activity from Andorra, a small country with no legitimate reason for scanning the application"],"likely_automated":true,"pattern":"The attack pattern involves automated scanning of sensitive files and directories using multiple user agents, likely to evade detection.","recommendation":"ban permanently","summary":"The IP address 93.123.109.214 is engaged in multiple exploit scans targeting sensitive files and directories, which are blocked on numerous DNS blocklists. This activity indicates a high-level threat.","threat_level":"critical"},"error":null,"geo":{"as":"AS48090 TECHOFF SRV LIMITED","city":"Andorra la Vella","country":"Andorra","countryCode":"AD","hosting":false,"isp":"Techoff SRV Limited","lat":42.5063,"lon":1.52184,"mobile":false,"org":"Techoff SRV Limited","proxy":true,"regionName":"Andorra la Vella","status":"success","timezone":"Europe/Andorra"},"ip":"93.123.109.214","log_count":6,"webcheck":{"block_lists":{"blocklists":[{"isBlocked":true,"server":"AdGuard","serverIp":"176.103.130.130"},{"isBlocked":true,"server":"AdGuard Family","serverIp":"176.103.130.132"},{"isBlocked":true,"server":"CleanBrowsing Adult","serverIp":"185.228.168.10"},{"isBlocked":true,"server":"CleanBrowsing Family","serverIp":"185.228.168.168"},{"isBlocked":true,"server":"CleanBrowsing Security","serverIp":"185.228.168.9"},{"isBlocked":true,"server":"CloudFlare","serverIp":"1.1.1.1"},{"isBlocked":true,"server":"CloudFlare Family","serverIp":"1.1.1.3"},{"isBlocked":true,"server":"Comodo Secure","serverIp":"8.26.56.26"},{"isBlocked":true,"server":"Google DNS","serverIp":"8.8.8.8"},{"isBlocked":true,"server":"Neustar Family","serverIp":"156.154.70.3"},{"isBlocked":true,"server":"Neustar Protection","serverIp":"156.154.70.2"},{"isBlocked":true,"server":"Norton Family","serverIp":"199.85.126.20"},{"isBlocked":true,"server":"OpenDNS","serverIp":"208.67.222.222"},{"isBlocked":true,"server":"OpenDNS Family","serverIp":"208.67.222.123"},{"isBlocked":true,"server":"Quad9","serverIp":"9.9.9.9"},{"isBlocked":true,"server":"Yandex Family","serverIp":"77.88.8.7"},{"isBlocked":true,"server":"Yandex Safe","serverIp":"77.88.8.88"}]},"dns":{"A":{"address":"93.123.109.214","family":4},"AAAA":[],"CNAME":[],"MX":[],"NS":[],"PTR":[],"SOA":[],"SRV":[],"TXT":[]},"ports":{"failedPorts":[20,21,23,25,53,67,68,69,80,110,119,123,143,156,161,162,179,194,389,443,587,993,995,3000,3306,3389,5060,5900,8000,8080,8888],"openPorts":[22]},"trace_route":{"message":"Traceroute completed!","result":[{"172.17.0.1":[1.054]},{"192.168.1.1":[0.917]},{"100.64.3.3":[56.529]},{"45.38.16.2":[56.465]},{"85.12.50.76":[56.408]},{"128.241.9.66":[56.345]},{"129.250.2.124":[56.762]},{"129.250.2.110":[133.33]},{"129.250.5.57":[133.272]},{"5.158.213.21":[133.758]},{"87.245.232.123":[137.664]},false,false,{"93.123.109.214":[138.144]}]}}}