{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8321661353111267, "class": 0 } ], "prob": 0.83216614, "class": 0, "models": [ { "m": "az", "prob": 0.4459851, "class": 0 }, { "m": "az/scripts", "prob": 0.19373892, "class": 0 }, { "m": "az/php", "prob": 0.83216614, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T17:21:11Z" }, "path": "unusual_activity.php", "raw": { "v": "4", "fs": [ { "f": "H₂(CmDb₃)Md₂(Pt)", "k": { "source.imports[0]": "header", "source.imports[1]": "isset", "source.imports[2]": "ob_start", "source.imports[3]": "rand", "source.imports[4]": "session_start", "source.strings[0]": "../extra/languages/", "source.strings[1]": "../extra/languages/{$_SESSION['language']}.php", "source.strings[2]": "../news/news-", "source.strings[3]": "../prevents/anti1.php", "source.strings[4]": "../prevents/anti2.php", "source.strings[5]": "../prevents/anti3.php", "source.strings[6]": "../prevents/anti4.php", "source.strings[7]": "../prevents/anti5.php", "source.strings[8]": "../prevents/anti6.php", "source.strings[9]": "../prevents/anti7.php", "source.has_imports": true, "source.strings[10]": "../prevents/anti8.php", "source.strings[11]": "Location: index.php", "source.strings[12]": "Location: signin", "source.strings[13]": "bt_secure", "source.strings[14]": "footer", "source.strings[15]": "language", "source.strings[16]": "privacy", "source.strings[17]": "rotate", "source.strings[18]": "t9ebozse9cxcecwz8uee4(*)f~f6su~y64*7;;48dwxr\u003e\u0026://////" }, "x": 2, "id": 0, "is": [ "ob_start", "session_start", "isset", "header", "isset", "header", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand" ], "ms": { "file": { "size": 3863.0 }, "text": { "tab_count": 163.0, "digit_ratio": 0.1, "space_count": 172.0, "total_lines": 79.0, "char_entropy": 5.55, "mixed_indent": true, "unique_chars": 90.0, "import_density": 32.91, "string_density": 1.63, "avg_line_length": 47.91, "high_byte_ratio": 0.12, "max_line_length": 184.0, "non_ascii_ratio": 0.12, "last_line_length": 7.0, "long_token_count": 2.0, "most_common_char": "e", "whitespace_ratio": 0.11, "most_common_ratio": 0.05, "identifier_density": 0.46, "line_length_stddev": 39.51, "normalized_import_count": 2.93, "normalized_string_count": 14.51, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 7.0, "trailing_whitespace_lines": 2.0, "normalized_unique_identifiers": 1.27 }, "imports": { "total": 26.0, "unique_modules": 5.0, "third_party_count": 26.0, "third_party_ratio": 1.0 }, "strings": { "total": 129.0, "avg_length": 7.43, "max_length": 46.0, "path_count": 22.0, "avg_entropy": 1.88, "total_bytes": 959.0, "entropy_stddev": 0.97 }, "comments": { "chars": 600.0, "lines": 8.0, "total": 1.0, "to_code_ratio": 0.11, "url_in_comments": 1.0, "base64_in_comments": 1.0 }, "functions": {}, "identifiers": { "total": 36.0, "avg_length": 7.75, "max_length": 13.0, "min_length": 4.0, "avg_entropy": 2.48, "reuse_ratio": 0.22, "unique_count": 8.0, "length_stddev": 2.82, "all_lowercase_ratio": 0.88, "all_uppercase_ratio": 0.13, "underscore_prefix_count": 1.0 } }, "ss": [ [ 620, "../prevents/anti1.php" ], [ 621, "../prevents/anti1.php" ], [ 653, "../prevents/anti1.php" ], [ 654, "../prevents/anti1.php" ], [ 686, "../prevents/anti2.php" ], [ 687, "../prevents/anti2.php" ], [ 719, "../prevents/anti3.php" ], [ 720, "../prevents/anti3.php" ], [ 752, "../prevents/anti4.php" ], [ 753, "../prevents/anti4.php" ], [ 785, "../prevents/anti5.php" ], [ 786, "../prevents/anti5.php" ], [ 818, "../prevents/anti6.php" ], [ 819, "../prevents/anti6.php" ], [ 851, "../prevents/anti7.php" ], [ 852, "../prevents/anti7.php" ], [ 884, "../prevents/anti8.php" ], [ 885, "../prevents/anti8.php" ], [ 958, "language" ], [ 959, "language" ], [ 984, "Location: index.php" ], [ 985, "Location: index.php" ], [ 1025, "../extra/languages/{$_SESSION['language']}.php" ], [ 1026, "../extra/languages/" ], [ 1056, "language" ], [ 1057, "language" ], [ 1068, ".php" ], [ 1096, "EML" ], [ 1097, "EML" ], [ 1117, "Location: signin" ], [ 1118, "Location: signin" ], [ 1306, "\u003c!--" ], [ 1307, "\u003c!--" ], [ 1330, "--\u003e" ], [ 1331, "--\u003e" ], [ 1457, "\u003c!--" ], [ 1458, "\u003c!--" ], [ 1481, "--\u003e" ], [ 1482, "--\u003e" ], [ 1501, "\u003c!--" ], [ 1502, "\u003c!--" ], [ 1525, "--\u003e" ], [ 1526, "--\u003e" ], [ 1694, "title" ], [ 1695, "title" ], [ 1723, "\u003c!--" ], [ 1724, "\u003c!--" ], [ 1747, "--\u003e" ], [ 1748, "--\u003e" ], [ 1820, "\u003c!--" ], [ 1821, "\u003c!--" ], [ 1844, "--\u003e" ], [ 1845, "--\u003e" ], [ 2000, "\u003c!--" ], [ 2001, "\u003c!--" ], [ 2024, "--\u003e" ], [ 2025, "--\u003e" ], [ 2191, "../news/news-" ], [ 2192, "../news/news-" ], [ 2217, ".txt" ], [ 2218, ".txt" ], [ 2260, "\u003c!--" ], [ 2261, "\u003c!--" ], [ 2284, "--\u003e" ], [ 2285, "--\u003e" ], [ 2325, "\u003c!--" ], [ 2326, "\u003c!--" ], [ 2349, "--\u003e" ], [ 2350, "--\u003e" ], [ 2402, "\u003c!--" ], [ 2403, "\u003c!--" ], [ 2426, "--\u003e" ], [ 2427, "--\u003e" ], [ 2446, "\u003c!--" ], [ 2447, "\u003c!--" ], [ 2470, "--\u003e" ], [ 2471, "--\u003e" ], [ 2529, "\u003c!--" ], [ 2530, "\u003c!--" ], [ 2553, "--\u003e" ], [ 2554, "--\u003e" ], [ 2585, "\u003c!--" ], [ 2586, "\u003c!--" ], [ 2609, "--\u003e" ], [ 2610, "--\u003e" ], [ 2660, "head" ], [ 2661, "head" ], [ 2686, "\u003c!--" ], [ 2687, "\u003c!--" ], [ 2710, "--\u003e" ], [ 2711, "--\u003e" ], [ 2774, "body" ], [ 2775, "body" ], [ 2872, "bt_secure" ], [ 2873, "bt_secure" ], [ 2965, "\u003c!--" ], [ 2966, "\u003c!--" ], [ 2989, "--\u003e" ], [ 2990, "--\u003e" ], [ 3107, "rotate" ], [ 3108, "rotate" ], [ 3151, "\u003c!--" ], [ 3152, "\u003c!--" ], [ 3175, "--\u003e" ], [ 3176, "--\u003e" ], [ 3246, "\u003c!--" ], [ 3247, "\u003c!--" ], [ 3270, "--\u003e" ], [ 3271, "--\u003e" ], [ 3367, "footer" ], [ 3368, "footer" ], [ 3377, "privacy" ], [ 3378, "privacy" ], [ 3415, "\u003c!--" ], [ 3416, "\u003c!--" ], [ 3439, "--\u003e" ], [ 3440, "--\u003e" ], [ 3467, "\u003c!--" ], [ 3468, "\u003c!--" ], [ 3491, "--\u003e" ], [ 3492, "--\u003e" ], [ 3547, "footer" ], [ 3548, "footer" ], [ 3557, "legal" ], [ 3558, "legal" ], [ 3593, "\u003c!--" ], [ 3594, "\u003c!--" ], [ 3617, "--\u003e" ], [ 3618, "--\u003e" ], [ 1787, "xor", "t9ebozse9cxcecwz8uee4(*)f~f6su~y64*7;;48dwxr\u003e\u0026://////" ] ], "sz": 3863, "ts": [ { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "d": "hide keyword", "e": [ "hide" ], "i": "micro-behaviors/data/text/keywords/lexicon::hide", "l": 1 }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "c": 0.800000011920929, "d": "Generates HTML content (DOCTYPE)", "e": [ "\u003c!DOCTYPE html\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-doctype", "l": 2 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 79.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8399999737739563, "d": "\"session\" string-literal token", "e": [ "../extra/languages/{$_SESSION['language']}.php" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-8", "l": 1 }, { "c": 0.949999988079071, "d": "PHP open tag (\u003c?php)", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 } ], "sha": "790993e58a7fcfef22b5e5a734fe5651acf3584e57cb810d6aff65d2dd445e29", "path": "unusual_activity.php", "type": "php" } ], "tv": "0a4d2" } }