← Back to IP report

Log Explorer

Fact drill-down for 87.251.64.153

Risk 12 LOW Scope All time All-time facts 57 In-scope 57 Filtered 57 Seen 2023-08-18 → 2025-01-12

Freestyle query (contains)

Time (days, optional)

Page size 25 50 100 200

Apply Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

Annotator (exact) (any) trav — 18 base — 10 ua — 10 sfp — 9 fwprobe — 9 method — 1 Severity (exact) (any) 28 — 18 (none) — 10 34 — 9 26 — 9 8 — 8 6 — 2 10 — 1 Label (exact) (any) trav — 18 observed — 10 ua — 10 fwprobe — 9 sensitive_file — 9 method — 1

HTTP facets

Method (exact, case-insensitive) (any) GET — 54 \x16\x03\x01\x00 — 3 HTTP status (exact) (any) 404 — 30 (none) — 12 499 — 12 400 — 3

Snapshot facets

Subnet (exact) (any) 87.251.64.0/24 — 57 ASN (exact) (any) (none) — 57 Country / Region / City (exact)

(any country) Kazakhstan — 57 (any region) Almaty — 57

(any city) Almaty — 57

Org contains (ip_org or as_org_name)

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Start

End

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

trav 18 base 10 ua 10 sfp 9 fwprobe 9 method 1

Top labels (facts, in-scope)

trav 18 observed 10 ua 10 fwprobe 9 sensitive_file 9 method 1

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 2 — total 57 rows

← Prev Next →

#1 2025-01-12 18:34:30 event 4348582 GET http —

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#2 2025-01-12 18:34:30 event 4348581 GET 499

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#3 2025-01-12 18:34:30 event 4348582 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#4 2025-01-12 18:34:30 event 4348581 GET 499

ann ua 8 label ua

Request Very short User-Agent string

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

ua

rule

ua:very_short

conf

65.00

details

Short/generic UAs are common in basic scripts and commodity automation.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Very short User-Agent string

details

Short/generic UAs are common in basic scripts and commodity automation.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#5 2025-01-12 18:34:30 event 4348582 GET http —

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#6 2025-01-12 18:34:30 event 4348582 GET http —

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#7 2025-01-12 18:34:30 event 4348581 GET 499

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#8 2025-01-12 18:34:30 event 4348581 GET 499

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#9 2025-01-12 18:34:30 event 4348582 GET http —

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#10 2025-01-12 18:34:30 event 4348581 GET 499

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#11 2025-01-12 18:34:30 event 4348582 GET http —

ann fwprobe 28 label fwprobe

Request Fortinet SSL-VPN / remote login endpoint probe

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

fwprobe

rule

fwprobe:fortinet:remote_login_or_sslvpn

conf

90.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Fortinet SSL-VPN / remote login endpoint probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#12 2025-01-12 18:34:30 event 4348581 GET 499

ann fwprobe 28 label fwprobe

Request Fortinet SSL-VPN / remote login endpoint probe

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

fwprobe

rule

fwprobe:fortinet:remote_login_or_sslvpn

conf

90.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Fortinet SSL-VPN / remote login endpoint probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#13 2024-04-28 17:38:15 event 1300590 \X16\X03\X01\X00 400 bytes 157

ann base label observed

Request event observed

\x85-\x04\xFFH@\xE1\xFAV\xCC\xAB\xAA\xEBI9\xA3

referer

-

UA

-

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

\x85-\x04\xFFH@\xE1\xFAV\xCC\xAB\xAA\xEBI9\xA3

referer

-

UA

-

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#14 2024-04-28 17:38:15 event 1300590 \X16\X03\X01\X00 400 bytes 157

ann ua 8 label ua

Request Very short User-Agent string

\x85-\x04\xFFH@\xE1\xFAV\xCC\xAB\xAA\xEBI9\xA3

referer

-

UA

-

Annotation facts

label

ua

rule

ua:very_short

conf

65.00

details

Short/generic UAs are common in basic scripts and commodity automation.

More (full fields + snapshot) expand

url

\x85-\x04\xFFH@\xE1\xFAV\xCC\xAB\xAA\xEBI9\xA3

referer

-

UA

-

summary

Very short User-Agent string

details

Short/generic UAs are common in basic scripts and commodity automation.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#15 2024-04-28 17:38:15 event 1300590 \X16\X03\X01\X00 400 bytes 157

ann method 10 label method

Request Non-RFC HTTP method token

\x85-\x04\xFFH@\xE1\xFAV\xCC\xAB\xAA\xEBI9\xA3

referer

-

UA

-

Annotation facts

label

method

rule

method:non_rfc_token

conf

92.00

details

HTTP method contains characters not allowed by RFC 9110 token grammar (often request smuggling/probing artifacts).

More (full fields + snapshot) expand

url

\x85-\x04\xFFH@\xE1\xFAV\xCC\xAB\xAA\xEBI9\xA3

referer

-

UA

-

summary

Non-RFC HTTP method token

details

HTTP method contains characters not allowed by RFC 9110 token grammar (often request smuggling/probing artifacts).

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#16 2024-02-22 05:50:47 event 1134059 GET 499

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#17 2024-02-22 05:50:47 event 1134058 GET http —

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#18 2024-02-22 05:50:47 event 1134059 GET 499

ann ua 8 label ua

Request Very short User-Agent string

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

ua

rule

ua:very_short

conf

65.00

details

Short/generic UAs are common in basic scripts and commodity automation.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Very short User-Agent string

details

Short/generic UAs are common in basic scripts and commodity automation.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#19 2024-02-22 05:50:47 event 1134058 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#20 2024-02-22 05:50:47 event 1134059 GET 499

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#21 2024-02-22 05:50:47 event 1134059 GET 499

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#22 2024-02-22 05:50:47 event 1134058 GET http —

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#23 2024-02-22 05:50:47 event 1134058 GET http —

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#24 2024-02-22 05:50:47 event 1134059 GET 499

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#25 2024-02-22 05:50:47 event 1134058 GET http —

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#26 2024-02-22 05:50:47 event 1134059 GET 499

ann fwprobe 28 label fwprobe

Request Fortinet SSL-VPN / remote login endpoint probe

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

fwprobe

rule

fwprobe:fortinet:remote_login_or_sslvpn

conf

90.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Fortinet SSL-VPN / remote login endpoint probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#27 2024-02-22 05:50:47 event 1134058 GET http —

ann fwprobe 28 label fwprobe

Request Fortinet SSL-VPN / remote login endpoint probe

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

Annotation facts

label

fwprobe

rule

fwprobe:fortinet:remote_login_or_sslvpn

conf

90.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

—

UA

—

summary

Fortinet SSL-VPN / remote login endpoint probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#28 2023-10-22 16:21:11 event 457204 GET 404 bytes 6385

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#29 2023-10-22 16:21:11 event 457203 GET 404 bytes 6385

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#30 2023-10-22 16:21:11 event 457204 GET 404 bytes 6385

ann ua 8 label ua

Request Very short User-Agent string

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

ua

rule

ua:very_short

conf

65.00

details

Short/generic UAs are common in basic scripts and commodity automation.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Very short User-Agent string

details

Short/generic UAs are common in basic scripts and commodity automation.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#31 2023-10-22 16:21:11 event 457203 GET 404 bytes 6385

ann ua 8 label ua

Request Very short User-Agent string

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

ua

rule

ua:very_short

conf

65.00

details

Short/generic UAs are common in basic scripts and commodity automation.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Very short User-Agent string

details

Short/generic UAs are common in basic scripts and commodity automation.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#32 2023-10-22 16:21:11 event 457204 GET 404 bytes 6385

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#33 2023-10-22 16:21:11 event 457204 GET 404 bytes 6385

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#34 2023-10-22 16:21:11 event 457203 GET 404 bytes 6385

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#35 2023-10-22 16:21:11 event 457203 GET 404 bytes 6385

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#36 2023-10-22 16:21:11 event 457204 GET 404 bytes 6385

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#37 2023-10-22 16:21:11 event 457203 GET 404 bytes 6385

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#38 2023-10-22 16:21:11 event 457204 GET 404 bytes 6385

ann fwprobe 28 label fwprobe

Request Fortinet SSL-VPN / remote login endpoint probe

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

fwprobe

rule

fwprobe:fortinet:remote_login_or_sslvpn

conf

90.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Fortinet SSL-VPN / remote login endpoint probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#39 2023-10-22 16:21:11 event 457203 GET 404 bytes 6385

ann fwprobe 28 label fwprobe

Request Fortinet SSL-VPN / remote login endpoint probe

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

fwprobe

rule

fwprobe:fortinet:remote_login_or_sslvpn

conf

90.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Fortinet SSL-VPN / remote login endpoint probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#40 2023-10-09 13:45:56 event 217769 GET 404 bytes 179

ann ua 8 label ua

Request Very short User-Agent string

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

ua

rule

ua:very_short

conf

65.00

details

Short/generic UAs are common in basic scripts and commodity automation.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Very short User-Agent string

details

Short/generic UAs are common in basic scripts and commodity automation.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#41 2023-10-09 13:45:56 event 217769 GET 404 bytes 179

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#42 2023-10-09 13:45:56 event 217769 GET 404 bytes 179

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#43 2023-10-09 13:45:56 event 217769 GET 404 bytes 179

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#44 2023-10-09 13:45:56 event 217769 GET 404 bytes 179

ann fwprobe 28 label fwprobe

Request Fortinet SSL-VPN / remote login endpoint probe

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

fwprobe

rule

fwprobe:fortinet:remote_login_or_sslvpn

conf

90.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Fortinet SSL-VPN / remote login endpoint probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#45 2023-10-09 13:45:56 event 217769 GET 404 bytes 179

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#46 2023-08-19 17:26:01 event 187166 GET 404 bytes 179

ann base label observed

Request event observed

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

event observed

details

—

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#47 2023-08-19 17:26:01 event 187166 GET 404 bytes 179

ann ua 8 label ua

Request Very short User-Agent string

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

ua

rule

ua:very_short

conf

65.00

details

Short/generic UAs are common in basic scripts and commodity automation.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Very short User-Agent string

details

Short/generic UAs are common in basic scripts and commodity automation.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#48 2023-08-19 17:26:01 event 187166 GET 404 bytes 179

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#49 2023-08-19 17:26:01 event 187166 GET 404 bytes 179

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

#50 2023-08-19 17:26:01 event 187166 GET 404 bytes 179

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

referer

-

UA

-

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

87.251.64.0/24

asn

—

geo

Kazakhstan, Almaty, Almaty

org

Bashin

Page 1 of 2

← Prev Next →