{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9967334270477295, "class": 2 } ], "prob": 0.9967334, "class": 2, "models": [ { "m": "az", "prob": 0.7487266, "class": 0 }, { "m": "az/scripts", "prob": 0.76050323, "class": 0 }, { "m": "az/php", "prob": 0.9967334, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T22:50:19Z" }, "path": "antibots4.php", "raw": { "v": "4", "fs": [ { "f": "O₇(AlAsC₂Dy₂ILaS)H₃(Cm₂Db₃Po)Md₂(Pt)", "k": { "source.imports[0]": "gethostbyaddr", "source.imports[1]": "header", "source.imports[2]": "in_array", "source.imports[3]": "preg_match", "source.imports[4]": "substr_count", "source.strings[0]": "/teoma", "source.strings[1]": "Googlebot', \r\n 'Baiduspider', \r\n 'ia_archiver',\r\n 'R6_FeedFetcher', \r\n 'NetcraftSurveyAgent', \r\n 'Sogou web spider',\r\n 'bingbot', \r\n 'Yahoo! Slurp', \r\n 'facebookexternalhit', \r\n 'PrintfulBot',\r\n 'msnbot', \r\n 'Twitterbot', \r\n 'UnwindFetchor', \r\n 'urlresolver', \r\n 'Butterfly', \r\n 'TweetmemeBot',\r\n 'PaperLiBot',\r\n 'MJ12bot',\r\n 'AhrefsBot',\r\n 'Exabot',\r\n 'Ezooms',\r\n 'YandexBot',\r\n 'SearchmetricsBot',\r\n 'picsearch',\r\n 'TweetedTimes Bot',\r\n 'QuerySeekerSpider',\r\n 'ShowyouBot',\r\n 'woriobot',\r\n 'merlinkbot',\r\n 'BazQuxBot',\r\n 'Kraken',\r\n 'SISTRIX Crawler',\r\n 'R6_CommentReader',\r\n 'magpie-crawler',\r\n 'GrapeshotCrawler',\r\n 'PercolateCrawler',\r\n 'MaxPointCrawler',\r\n 'R6_FeedFetcher',\r\n 'NetSeer crawler',\r\n 'grokkit-crawler',\r\n 'SMXCrawler',\r\n 'PulseCrawler',\r\n 'Y!J-BRW',\r\n '80legs.com/webcrawler',\r\n 'Mediapartners-Google', \r\n 'Spinn3r', \r\n 'InAGist', \r\n 'Python-urllib', \r\n 'NING', \r\n 'TencentTraveler',\r\n 'Feedfetcher-Google', \r\n 'mon.itor.us', \r\n 'spbot', \r\n 'Feedly',\r\n 'bot',\r\n 'curl',\r\n spider,\r\n crawler", "source.strings[2]": "REMOTE_ADDR", "source.strings[3]": "accoona", "source.strings[4]": "adressendeutschland", "source.strings[5]": "ah-ha.com", "source.strings[6]": "altavista", "source.strings[7]": "ananzi", "source.strings[8]": "anthill", "source.strings[9]": "arachnophilia", "source.has_imports": true, "source.strings[10]": "araneo", "source.strings[11]": "aranha", "source.strings[12]": "architext", "source.strings[13]": "aretha", "source.strings[14]": "asterias", "source.strings[15]": "atlocal", "source.strings[16]": "augurfind", "source.strings[17]": "backrub", "source.strings[18]": "bannana_bot", "source.strings[19]": "baypup", "source.strings[20]": "bdfetch", "source.strings[21]": "big brother", "source.strings[22]": "biglotron", "source.strings[23]": "bjaaland", "source.strings[24]": "blackwidow", "source.strings[25]": "bloodhound", "source.strings[26]": "boitho", "source.strings[27]": "bradley", "source.strings[28]": "butterfly", "source.strings[29]": "cassandra", "source.strings[30]": "ccubee", "source.strings[31]": "cfetch", "source.strings[32]": "charlotte", "source.strings[33]": "cienciaficcion", "source.strings[34]": "collective", "source.strings[35]": "comagent", "source.strings[36]": "combine", "source.strings[37]": "computingsite", "source.strings[38]": "daumoa", "source.strings[39]": "deepindex", "source.strings[40]": "delorie", "source.strings[41]": "depspid", "source.strings[42]": "digger", "source.strings[43]": "docomo", "source.strings[44]": "download express", "source.strings[45]": "dtaagent", "source.strings[46]": "e-collector", "source.strings[47]": "ebiness", "source.strings[48]": "ebingbong", "source.strings[49]": "echo blinde kuh", "source.strings[50]": "ejupiter", "source.strings[51]": "emacs-w3 search engine", "source.strings[52]": "esther", "source.strings[53]": "evliya celebi", "source.strings[54]": "ezresult", "source.strings[55]": "falcon", "source.strings[56]": "felix ide", "source.strings[57]": "ferret", "source.strings[58]": "fetchrover", "source.strings[59]": "findlinks", "source.strings[60]": "fireball", "source.strings[61]": "fish search", "source.strings[62]": "fouineur", "source.strings[63]": "funnelweb", "source.strings[64]": "gcreep", "source.strings[65]": "genieknows", "source.strings[66]": "getterroboplus", "source.strings[67]": "geturl", "source.strings[68]": "goforit", "source.strings[69]": "grabber", "source.strings[70]": "gralon", "source.strings[71]": "grapnel", "source.strings[72]": "griffon", "source.strings[73]": "gromit", "source.strings[74]": "gulliver", "source.strings[75]": "hamahakki", "source.strings[76]": "harvest", "source.strings[77]": "havindex", "source.strings[78]": "heritrix", "source.strings[79]": "hku www octopus", "source.strings[80]": "homerweb", "source.strings[81]": "html index", "source.strings[82]": "html_analyzer", "source.strings[83]": "htmlgobble", "source.strings[84]": "hubater", "source.strings[85]": "hyper-decontextualizer", "source.strings[86]": "ia_archiver", "source.strings[87]": "ibm_planetwide", "source.strings[88]": "ichiro", "source.strings[89]": "iconsurf", "source.strings[90]": "iltrovatore", "source.strings[91]": "image.kapsi.net", "source.strings[92]": "imagelock", "source.strings[93]": "incywincy", "source.strings[94]": "indexer", "source.strings[95]": "infobee", "source.strings[96]": "informant", "source.strings[97]": "ingrid", "source.strings[98]": "inktomisearch.com", "source.strings[99]": "inspector web", "source.strings[100]": "intelliagent", "source.strings[101]": "internet shinchakubin", "source.strings[102]": "ip3000", "source.strings[103]": "iron33", "source.strings[104]": "israeli-search", "source.strings[105]": "jakarta", "source.strings[106]": "javabee", "source.strings[107]": "jetbot", "source.strings[108]": "jumpstation", "source.strings[109]": "katipo", "source.strings[110]": "kdd-explorer", "source.strings[111]": "kilroy", "source.strings[112]": "knowledge", "source.strings[113]": "kototoi", "source.strings[114]": "kretrieve", "source.strings[115]": "labelgrabber", "source.strings[116]": "lachesis", "source.strings[117]": "larbin", "source.strings[118]": "libwww", "source.strings[119]": "link validator", "source.strings[120]": "linkalarm", "source.strings[121]": "linkscan", "source.strings[122]": "lockon", "source.strings[123]": "magpie", "source.strings[124]": "mantraagent", "source.strings[125]": "mapoftheinternet", "source.strings[126]": "marvin/", "source.strings[127]": "mattie", "source.strings[128]": "mediafox", "source.strings[129]": "mediapartners", "source.strings[130]": "mercator", "source.strings[131]": "merzscope", "source.strings[132]": "microsoft url control", "source.strings[133]": "minirank", "source.strings[134]": "mnogosearch", "source.strings[135]": "monster", "source.strings[136]": "multitext", "source.strings[137]": "muncher", "source.strings[138]": "muscatferret", "source.strings[139]": "mwd.search", "source.strings[140]": "nameprotect", "source.strings[141]": "nationaldirectory", "source.strings[142]": "nazilla", "source.strings[143]": "ncsa beta", "source.strings[144]": "nec-meshexplorer", "source.strings[145]": "nederland.zoek", "source.strings[146]": "netcarta webmap engine", "source.strings[147]": "netmechanic", "source.strings[148]": "netresearchserver", "source.strings[149]": "netscoop", "source.strings[150]": "newscan-online", "source.strings[151]": "nokia6682/", "source.strings[152]": "noyona", "source.strings[153]": "nzexplorer", "source.strings[154]": "objectssearch", "source.strings[155]": "open text", "source.strings[156]": "openfind", "source.strings[157]": "openintelligencedata", "source.strings[158]": "orb search", "source.strings[159]": "osis-project", "source.strings[160]": "pack rat", "source.strings[161]": "page_verifier", "source.strings[162]": "pageboy", "source.strings[163]": "pagebull", "source.strings[164]": "panscient", "source.strings[165]": "parasite", "source.strings[166]": "partnersite", "source.strings[167]": "patric", "source.strings[168]": "pegasus", "source.strings[169]": "peregrinator", "source.strings[170]": "pgp key agent", "source.strings[171]": "phantom", "source.strings[172]": "phpdig", "source.strings[173]": "picosearch", "source.strings[174]": "piltdownman", "source.strings[175]": "pimptrain", "source.strings[176]": "pinpoint", "source.strings[177]": "pioneer", "source.strings[178]": "piranha", "source.strings[179]": "plumtreewebaccessor", "source.strings[180]": "pogodak", "source.strings[181]": "poirot", "source.strings[182]": "pompos", "source.strings[183]": "poppelsdorf", "source.strings[184]": "popular iconoclast", "source.strings[185]": "psycheclone", "source.strings[186]": "publisher", "source.strings[187]": "python", "source.strings[188]": "rambler", "source.strings[189]": "raven search", "source.strings[190]": "road runner", "source.strings[191]": "roadhouse", "source.strings[192]": "robbie", "source.strings[193]": "robofox", "source.strings[194]": "robozilla", "source.strings[195]": "sbider", "source.strings[196]": "scooter", "source.strings[197]": "scoutjet", "source.strings[198]": "scrubby", "source.strings[199]": "search.", "source.strings[200]": "searchprocess", "source.strings[201]": "semanticdiscovery", "source.strings[202]": "senrigan", "source.strings[203]": "sg-scout", "source.strings[204]": "shai'hulud", "source.strings[205]": "shopwiki", "source.strings[206]": "sidewinder", "source.strings[207]": "simmany", "source.strings[208]": "site searcher", "source.strings[209]": "site valet", "source.strings[210]": "sitetech-rover", "source.strings[211]": "skymob.com", "source.strings[212]": "smartwit", "source.strings[213]": "snappy", "source.strings[214]": "snooper", "source.strings[215]": "speedfind", "source.strings[216]": "sphere", "source.strings[217]": "sphider", "source.strings[218]": "spider", "source.strings[219]": "spinner", "source.strings[220]": "spyder", "source.strings[221]": "steeler/", "source.strings[222]": "suntek", "source.strings[223]": "supersnooper", "source.strings[224]": "surfnomore", "source.strings[225]": "szukacz", "source.strings[226]": "t-h-u-n-d-e-r-s-t-o-n-e", "source.strings[227]": "tach black widow", "source.strings[228]": "tarantula", "source.strings[229]": "templeton", "source.strings[230]": "theophrastus", "source.strings[231]": "toutatis", "source.strings[232]": "tutorgig", "source.strings[233]": "twiceler", "source.strings[234]": "twisted", "source.strings[235]": "udmsearch", "source.strings[236]": "updated", "source.strings[237]": "url check", "source.strings[238]": "vagabondo", "source.strings[239]": "valkyrie", "source.strings[240]": "verticrawl", "source.strings[241]": "victoria", "source.strings[242]": "vision-search", "source.strings[243]": "volcano", "source.strings[244]": "voyager-hc", "source.strings[245]": "voyager/", "source.strings[246]": "w3c_validator", "source.strings[247]": "walker", "source.strings[248]": "wallpaper", "source.strings[249]": "wanderer", "source.strings[250]": "wavefire", "source.strings[251]": "web core", "source.strings[252]": "web hopper", "source.strings[253]": "web wombat", "source.strings[254]": "webbandit", "source.strings[255]": "webcatcher" }, "x": 38, "id": 0, "is": [ "gethostbyaddr", "substr_count", "header", "in_array", "header", "preg_match", "header" ], "ms": { "file": { "size": 11409.0 }, "text": { "tab_count": 2.0, "digit_ratio": 0.13, "space_count": 3772.0, "total_lines": 463.0, "char_entropy": 4.33, "mixed_indent": true, "unique_chars": 88.0, "import_density": 1.51, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 2.08, "avg_line_length": 22.65, "lines_over_1000": 1.0, "max_line_length": 1385.0, "empty_line_ratio": 0.01, "last_line_length": 2.0, "most_common_char": "\"", "whitespace_ratio": 0.41, "most_common_ratio": 0.08, "identifier_density": 0.05, "line_length_stddev": 63.69, "normalized_import_count": 0.33, "normalized_string_count": 44.71, "repeated_char_sequences": 4.0, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 22.0, "normalized_unique_identifiers": 1.24 }, "imports": { "total": 7.0, "unique_modules": 5.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "strings": { "total": 962.0, "ip_count": 2.0, "avg_length": 11.7, "max_length": 1408.0, "path_count": 4.0, "avg_entropy": 2.59, "total_bytes": 11254.0, "domain_count": 8.0, "entropy_stddev": 0.53, "very_long_strings": 2.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 21.0, "avg_length": 8.27, "max_length": 13.0, "min_length": 2.0, "avg_entropy": 2.63, "reuse_ratio": 0.52, "unique_count": 11.0, "length_stddev": 3.39, "all_lowercase_ratio": 0.82, "all_uppercase_ratio": 0.09, "underscore_prefix_count": 1.0 } }, "ss": [ [ 46, "REMOTE_ADDR" ], [ 47, "REMOTE_ADDR" ], [ 93, "Googlebot', \r\n 'Baiduspider', \r\n 'ia_archiver',\r\n 'R6_FeedFetcher', \r\n 'NetcraftSurveyAgent', \r\n " ], [ 94, "Googlebot', \r\n 'Baiduspider', \r\n 'ia_archiver',\r\n 'R6_FeedFetcher', \r\n 'NetcraftSurveyAgent', \r\n " ], [ 1509, "abot" ], [ 1510, "abot" ], [ 1526, "dbot" ], [ 1527, "dbot" ], [ 1543, "ebot" ], [ 1544, "ebot" ], [ 1560, "hbot" ], [ 1561, "hbot" ], [ 1577, "kbot" ], [ 1578, "kbot" ], [ 1594, "lbot" ], [ 1595, "lbot" ], [ 1611, "mbot" ], [ 1612, "mbot" ], [ 1628, "nbot" ], [ 1629, "nbot" ], [ 1645, "obot" ], [ 1646, "obot" ], [ 1662, "pbot" ], [ 1663, "pbot" ], [ 1679, "rbot" ], [ 1680, "rbot" ], [ 1696, "sbot" ], [ 1697, "sbot" ], [ 1713, "tbot" ], [ 1714, "tbot" ], [ 1730, "vbot" ], [ 1731, "vbot" ], [ 1747, "ybot" ], [ 1748, "ybot" ], [ 1764, "zbot" ], [ 1765, "zbot" ], [ 1781, "bot." ], [ 1782, "bot." ], [ 1798, "bot/" ], [ 1799, "bot/" ], [ 1815, "_bot" ], [ 1816, "_bot" ], [ 1832, ".bot" ], [ 1833, ".bot" ], [ 1849, "/bot" ], [ 1850, "/bot" ], [ 1866, "-bot" ], [ 1867, "-bot" ], [ 1883, "bot" ], [ 1884, "bot" ], [ 1900, "(bot" ], [ 1901, "(bot" ], [ 1917, "crawl" ], [ 1918, "crawl" ], [ 1935, "slurp" ], [ 1936, "slurp" ], [ 1953, "spider" ], [ 1954, "spider" ], [ 1972, "seek" ], [ 1973, "seek" ], [ 1989, "accoona" ], [ 1990, "accoona" ], [ 2009, "acoon" ], [ 2010, "acoon" ], [ 2027, "adressendeutschland" ], [ 2028, "adressendeutschland" ], [ 2059, "ah-ha.com" ], [ 2060, "ah-ha.com" ], [ 2081, "ahoy" ], [ 2082, "ahoy" ], [ 2098, "altavista" ], [ 2099, "altavista" ], [ 2120, "ananzi" ], [ 2121, "ananzi" ], [ 2139, "anthill" ], [ 2140, "anthill" ], [ 2159, "appie" ], [ 2160, "appie" ], [ 2177, "arachnophilia" ], [ 2178, "arachnophilia" ], [ 2203, "arale" ], [ 2204, "arale" ], [ 2221, "araneo" ], [ 2222, "araneo" ], [ 2240, "aranha" ], [ 2241, "aranha" ], [ 2259, "architext" ], [ 2260, "architext" ], [ 2281, "aretha" ], [ 2282, "aretha" ], [ 2300, "arks" ], [ 2301, "arks" ], [ 2317, "asterias" ], [ 2318, "asterias" ], [ 2338, "atlocal" ], [ 2339, "atlocal" ], [ 2358, "atn" ], [ 2359, "atn" ], [ 2374, "atomz" ], [ 2375, "atomz" ], [ 2392, "augurfind" ], [ 2393, "augurfind" ], [ 2414, "backrub" ], [ 2415, "backrub" ], [ 2434, "bannana_bot" ], [ 2435, "bannana_bot" ], [ 2458, "baypup" ], [ 2459, "baypup" ], [ 2477, "bdfetch" ], [ 2478, "bdfetch" ], [ 2497, "big brother" ], [ 2498, "big brother" ], [ 2521, "biglotron" ], [ 2522, "biglotron" ], [ 2543, "bjaaland" ], [ 2544, "bjaaland" ], [ 2564, "blackwidow" ], [ 2565, "blackwidow" ], [ 2587, "blaiz" ], [ 2588, "blaiz" ], [ 2605, "blog" ], [ 2606, "blog" ], [ 2622, "blo." ], [ 2623, "blo." ], [ 2639, "bloodhound" ], [ 2640, "bloodhound" ], [ 2662, "boitho" ], [ 2663, "boitho" ], [ 2681, "booch" ], [ 2682, "booch" ], [ 2699, "bradley" ], [ 2700, "bradley" ], [ 2719, "butterfly" ], [ 2720, "butterfly" ], [ 2741, "calif" ], [ 2742, "calif" ], [ 2759, "cassandra" ], [ 2760, "cassandra" ], [ 2781, "ccubee" ], [ 2782, "ccubee" ], [ 2800, "cfetch" ], [ 2801, "cfetch" ], [ 2819, "charlotte" ], [ 2820, "charlotte" ], [ 2841, "churl" ], [ 2842, "churl" ], [ 2859, "cienciaficcion" ], [ 2860, "cienciaficcion" ], [ 2886, "cmc" ], [ 2887, "cmc" ], [ 2902, "collective" ], [ 2903, "collective" ], [ 2925, "comagent" ], [ 2926, "comagent" ], [ 2946, "combine" ], [ 2947, "combine" ], [ 2966, "computingsite" ], [ 2967, "computingsite" ], [ 2992, "csci" ], [ 2993, "csci" ], [ 3009, "curl" ], [ 3010, "curl" ], [ 3026, "cusco" ], [ 3027, "cusco" ], [ 3044, "daumoa" ], [ 3045, "daumoa" ], [ 3063, "deepindex" ], [ 3064, "deepindex" ], [ 3085, "delorie" ], [ 3086, "delorie" ], [ 3105, "depspid" ], [ 3106, "depspid" ], [ 3125, "deweb" ], [ 3126, "deweb" ], [ 3143, "echo blinde kuh" ], [ 3144, "echo blinde kuh" ], [ 3171, "digger" ], [ 3172, "digger" ], [ 3190, "ditto" ], [ 3191, "ditto" ], [ 3208, "dmoz" ], [ 3209, "dmoz" ], [ 3225, "docomo" ], [ 3226, "docomo" ], [ 3244, "download express" ], [ 3245, "download express" ], [ 3273, "dtaagent" ], [ 3274, "dtaagent" ], [ 3294, "dwcp" ], [ 3295, "dwcp" ], [ 3311, "ebiness" ], [ 3312, "ebiness" ], [ 3331, "ebingbong" ], [ 3332, "ebingbong" ], [ 3353, "e-collector" ], [ 3354, "e-collector" ], [ 3377, "ejupiter" ], [ 3378, "ejupiter" ], [ 3398, "emacs-w3 search engine" ], [ 3399, "emacs-w3 search engine" ], [ 3433, "esther" ], [ 3434, "esther" ], [ 3452, "evliya celebi" ], [ 3453, "evliya celebi" ], [ 3478, "ezresult" ], [ 3479, "ezresult" ], [ 3499, "falcon" ], [ 3500, "falcon" ], [ 3518, "felix ide" ], [ 3519, "felix ide" ], [ 3540, "ferret" ], [ 3541, "ferret" ], [ 3559, "fetchrover" ], [ 3560, "fetchrover" ], [ 3582, "fido" ], [ 3583, "fido" ], [ 3599, "findlinks" ], [ 3600, "findlinks" ], [ 3621, "fireball" ], [ 3622, "fireball" ], [ 3642, "fish search" ], [ 3643, "fish search" ], [ 3666, "fouineur" ], [ 3667, "fouineur" ], [ 3687, "funnelweb" ], [ 3688, "funnelweb" ], [ 3709, "gazz" ], [ 3710, "gazz" ], [ 3726, "gcreep" ], [ 3727, "gcreep" ], [ 3745, "genieknows" ], [ 3746, "genieknows" ], [ 3768, "getterroboplus" ], [ 3769, "getterroboplus" ], [ 3795, "geturl" ], [ 3796, "geturl" ], [ 3814, "glx" ], [ 3815, "glx" ], [ 3830, "goforit" ], [ 3831, "goforit" ], [ 3850, "golem" ], [ 3851, "golem" ], [ 3868, "grabber" ], [ 3869, "grabber" ], [ 3888, "grapnel" ], [ 3889, "grapnel" ], [ 3908, "gralon" ], [ 3909, "gralon" ], [ 3927, "griffon" ], [ 3928, "griffon" ], [ 3947, "gromit" ], [ 3948, "gromit" ], [ 3966, "grub" ], [ 3967, "grub" ], [ 3983, "gulliver" ], [ 3984, "gulliver" ] ], "sz": 11409, "ts": [ { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-4", "l": 1 }, { "a": "T1110.001", "c": 0.8999999761581421, "d": "Weak password monkey", "e": [ "monkey" ], "i": "objectives/lateral-movement/brute-force/password::weak-pass-monkey", "l": 1, "m": "E1110" }, { "c": 0.8199999928474426, "d": "Hostname profile field", "e": [ "hostname" ], "i": "objectives/discovery/system/profile::host-profile-hostname-field", "l": 1 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "Googlebot" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-1", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ "HTTP/1.0 404 Not Found" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Amplification payload suffix after chr() sequence", "e": [ "\"rules\"" ], "i": "objectives/impact/dos/amplification::amplification-payload-common-chr-suffix", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1217", "c": 0.4000000059604645, "d": "Yandex browser name", "e": [ "Yandex" ], "i": "objectives/discovery/host/browser::yandex-name", "l": 3 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1385.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 463.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "Speed" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-77", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 1408.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "facebookexternalhit" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-3", "l": 1 }, { "c": 0.75, "d": "Googlebot token reference", "e": [ "Googlebot" ], "i": "objectives/supply-chain/hidden-payload/trojan::googlebot-token", "l": 1 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "Baiduspider" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-2", "l": 1 }, { "c": 0.8999999761581421, "d": "cassandra string", "e": [ "cassandra" ], "i": "micro-behaviors/data/db/conn/cassandra::cassandra-string", "l": 3 }, { "c": 0.75, "d": "grabber keyword", "e": [ "grabber" ], "i": "micro-behaviors/data/text/malware/terms::grabber-word", "l": 3 }, { "c": 0.8500000238418579, "d": "Hardcoded external IPv4 address", "e": [ "68.65.53.71" ], "i": "micro-behaviors/communications/ip/literal::external-ipv4-script", "l": 4 }, { "c": 0.699999988079071, "d": "python interpreter keyword (beyond shebang)", "e": [ "python" ], "i": "micro-behaviors/process/interpreter/python::python-keyword", "l": 3 } ], "sha": "55ef5bd734497dc03788867433ebcbf557092ceef31a65f84d64fe0fab37095b", "path": "antibots4.php", "type": "php" } ], "tv": "87c42" } }