{"schema":4,"organizations":{"basis":"Shodan org field, latest usable name per IP within Thai PHP-evidence cohort","unit":"Unique IP assigned once; service endpoints are IP+port+transport","total_ips":15865,"total_services":44279,"named_ips":15669,"unknown_ips":196,"named_services":43989,"unknown_services":290,"organization_labels":395,"displayed_organizations":15,"top":[{"name":"Infrastructure","services":3746,"ips":1540},{"name":"Amazon.com, Inc.","services":3346,"ips":1484},{"name":"ADVANCED WIRELESS NETWORK COMPANY LIMITED","services":7663,"ips":1361},{"name":"Office of Info.Tech. Admin. for Educational Development","services":1607,"ips":1042},{"name":"TOT Public Company Limited","services":1881,"ips":899},{"name":"National Telecom Public Company Limited","services":689,"ips":488},{"name":"Triple T Broadband Public Company Limited","services":2567,"ips":466},{"name":"Internet Thailand Company Ltd.","services":596,"ips":404},{"name":"ReadyIDC Co., Ltd.","services":441,"ips":305},{"name":"AIS Fibre","services":3499,"ips":303},{"name":"True Internet Co., Ltd.","services":451,"ips":279},{"name":"10 Fl. 72. CAT TELECOM TOWER Bangrak Bangkok Thailand","services":353,"ips":278},{"name":"United Information Highway Co.,Ltd.","services":376,"ips":265},{"name":"TOT Public Company Limited Bangkok","services":1483,"ips":262},{"name":"CS Loxinfo Public Company Limited","services":356,"ips":259}],"other_ips":5639,"other_services":14412,"small_group_ips":395,"small_group_services":523,"minimum_display_ips":5,"notes":["Org describes an association reported by the data source; it can be a network, hosting or cloud provider, not the website owner.","Names are normalized for case and whitespace only; distinct labels are not verified legal entities.","One latest usable organization label per IP prevents double-counting between labels.","Top 15 groups by unique IP; groups below five IPs are aggregated, not named. No vulnerability ranking by organization is published."]},"vulnerability":{"scope":"Saved services on Thai PHP-evidence IPs; unique IP+port+transport; no target identifiers","reported":{"3.1":{"mode":"reported","metric":"3.1","counts":{"total_services":44279,"total_ips":15865,"with_findings":7059,"scored_services":6995,"partially_scored_services":6969,"pairs":1615285,"unscored_pairs":1202840,"rejected_pairs":0,"source_at_limit":0,"associated_ips":4567,"high_severity_ips":4489,"unique_cves":2477,"kev_services":5702,"kev_ips":3584},"partition":{"Critical":6712,"High":249,"Medium":34,"Low":0,"None":0,"Unknown":64,"No_findings":0,"Missing_evidence":37220,"Out_of_scope":0},"histogram":[{"score":0,"services":0},{"score":1,"services":0},{"score":2,"services":0},{"score":3,"services":0},{"score":4,"services":6},{"score":5,"services":19},{"score":6,"services":9},{"score":7,"services":131},{"score":8,"services":118},{"score":9,"services":6712},{"score":10,"services":0}],"top_cves":[{"id":"CVE-2007-3205","services":6579,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2007-3205","ips":4256},{"id":"CVE-2013-2220","services":6579,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-2220","ips":4256},{"id":"CVE-2024-3566","services":6055,"score":9.8,"metric":"3.1","severity":"Critical","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2024-3566","ips":3808},{"id":"CVE-2022-4900","services":5372,"score":6.2,"metric":"3.1","severity":"Medium","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2022-4900","ips":3221},{"id":"CVE-2024-25117","services":5319,"score":6.8,"metric":"3.1","severity":"Medium","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2024-25117","ips":3176},{"id":"CVE-2022-31628","services":5056,"score":2.3,"metric":"3.1","severity":"Low","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2022-31628","ips":2959},{"id":"CVE-2022-31629","services":5056,"score":6.5,"metric":"3.1","severity":"Medium","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2022-31629","ips":2959},{"id":"CVE-2007-4723","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2007-4723","ips":3182},{"id":"CVE-2009-0796","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2009-0796","ips":3182},{"id":"CVE-2009-2299","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2009-2299","ips":3182},{"id":"CVE-2011-1176","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2011-1176","ips":3182},{"id":"CVE-2011-2688","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2011-2688","ips":3182},{"id":"CVE-2012-3526","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2012-3526","ips":3182},{"id":"CVE-2012-4001","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2012-4001","ips":3182},{"id":"CVE-2012-4360","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2012-4360","ips":3182},{"id":"CVE-2013-0941","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-0941","ips":3182},{"id":"CVE-2013-0942","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-0942","ips":3182},{"id":"CVE-2013-2765","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-2765","ips":3182},{"id":"CVE-2013-4365","services":5022,"score":null,"metric":"3.1","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-4365","ips":3182},{"id":"CVE-2026-93546","services":5003,"score":8.8,"metric":"3.1","severity":"High","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2026-93546","ips":3167}],"other_cves":2457},"4.0":{"mode":"reported","metric":"4.0","counts":{"total_services":44279,"total_ips":15865,"with_findings":7059,"scored_services":4503,"partially_scored_services":4482,"pairs":1615285,"unscored_pairs":1593817,"rejected_pairs":0,"source_at_limit":0,"associated_ips":4567,"high_severity_ips":2860,"unique_cves":2477,"kev_services":5702,"kev_ips":3584},"partition":{"Critical":4146,"High":162,"Medium":195,"Low":0,"None":0,"Unknown":2556,"No_findings":0,"Missing_evidence":37220,"Out_of_scope":0},"histogram":[{"score":0,"services":0},{"score":1,"services":0},{"score":2,"services":0},{"score":3,"services":0},{"score":4,"services":0},{"score":5,"services":195},{"score":6,"services":0},{"score":7,"services":0},{"score":8,"services":162},{"score":9,"services":4146},{"score":10,"services":0}],"top_cves":[{"id":"CVE-2007-3205","services":6579,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2007-3205","ips":4256},{"id":"CVE-2013-2220","services":6579,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-2220","ips":4256},{"id":"CVE-2024-3566","services":6055,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2024-3566","ips":3808},{"id":"CVE-2022-4900","services":5372,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2022-4900","ips":3221},{"id":"CVE-2024-25117","services":5319,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2024-25117","ips":3176},{"id":"CVE-2022-31628","services":5056,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2022-31628","ips":2959},{"id":"CVE-2022-31629","services":5056,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2022-31629","ips":2959},{"id":"CVE-2007-4723","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2007-4723","ips":3182},{"id":"CVE-2009-0796","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2009-0796","ips":3182},{"id":"CVE-2009-2299","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2009-2299","ips":3182},{"id":"CVE-2011-1176","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2011-1176","ips":3182},{"id":"CVE-2011-2688","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2011-2688","ips":3182},{"id":"CVE-2012-3526","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2012-3526","ips":3182},{"id":"CVE-2012-4001","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2012-4001","ips":3182},{"id":"CVE-2012-4360","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2012-4360","ips":3182},{"id":"CVE-2013-0941","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-0941","ips":3182},{"id":"CVE-2013-0942","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-0942","ips":3182},{"id":"CVE-2013-2765","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-2765","ips":3182},{"id":"CVE-2013-4365","services":5022,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2013-4365","ips":3182},{"id":"CVE-2026-93546","services":5003,"score":null,"metric":"4.0","severity":"Unknown","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2026-93546","ips":3167}],"other_cves":2457}},"versions":{"4.0":{"mode":"versions","metric":"4.0","counts":{"total_services":44279,"total_ips":15865,"with_findings":33007,"scored_services":33007,"partially_scored_services":1986,"pairs":68008,"unscored_pairs":1994,"rejected_pairs":0,"source_at_limit":0,"associated_ips":13438,"high_severity_ips":13438,"unique_cves":5,"kev_services":1986,"kev_ips":1411},"partition":{"Critical":33007,"High":0,"Medium":0,"Low":0,"None":0,"Unknown":0,"No_findings":185,"Missing_evidence":8895,"Out_of_scope":2192},"histogram":[{"score":0,"services":0},{"score":1,"services":0},{"score":2,"services":0},{"score":3,"services":0},{"score":4,"services":0},{"score":5,"services":0},{"score":6,"services":0},{"score":7,"services":0},{"score":8,"services":0},{"score":9,"services":33007},{"score":10,"services":0}],"top_cves":[{"id":"CVE-2026-109618","services":33007,"score":9.2,"metric":"4.0","severity":"Critical","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2026-109618","ips":13438},{"id":"CVE-2026-109619","services":33007,"score":9.2,"metric":"4.0","severity":"Critical","kev":false,"source":"https://www.cve.org/CVERecord?id=CVE-2026-109619","ips":13438},{"id":"CVE-2024-4577","services":1978,"score":null,"metric":"4.0","severity":"Unknown","kev":true,"source":"https://www.cve.org/CVERecord?id=CVE-2024-4577","ips":1405},{"id":"CVE-2021-41773","services":8,"score":null,"metric":"4.0","severity":"Unknown","kev":true,"source":"https://www.cve.org/CVERecord?id=CVE-2021-41773","ips":6},{"id":"CVE-2021-42013","services":8,"score":null,"metric":"4.0","severity":"Unknown","kev":true,"source":"https://www.cve.org/CVERecord?id=CVE-2021-42013","ips":6}],"other_cves":0}},"catalog":{"updated_at":"2026-10-23T17:02:34.889947+00:00","kev_available":true,"kev_updated":"2026-10-21T14:04:39.8983Z"},"methodology":["Reported CVE associations are not verified vulnerabilities.","Version matches use selected PHP, Portable OpenSSH and Apache vendor rules; package backports and configuration remain unverified.","Each service is classified by the highest known base score for the selected CVSS version. No metric fallback, averaging or summing.","Partially scored services may have additional CVEs without scores; highest known is a lower bound.","Missing evidence is separate from an explicitly empty CVE list and is not a safe result. Rejected CVEs are excluded.","KEV indicates known exploitation of a CVE, not compromise of an observed host."],"sources":["https://www.first.org/cvss/","https://www.cve.org/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog"]},"service_profile":{"scope":"All observed service endpoints on Thai IPs with PHP evidence; not all Thai internet services","unit":"Unique IP + port + transport; latest observation across hostname aliases","total_endpoints":44279,"php_endpoints":44099,"unique_ports":5091,"web_endpoints":44198,"known_web_endpoints":37997,"unknown_web_endpoints":6201,"known_software_endpoints":39381,"unidentified_software_endpoints":4898,"inferred_service_endpoints":70,"ports":[{"name":"80/tcp","count":7203},{"name":"443/tcp","count":5894},{"name":"8080/tcp","count":817},{"name":"81/tcp","count":755},{"name":"8081/tcp","count":274},{"name":"8888/tcp","count":242},{"name":"8443/tcp","count":176},{"name":"8000/tcp","count":152},{"name":"88/tcp","count":131},{"name":"82/tcp","count":122},{"name":"2086/tcp","count":106},{"name":"2083/tcp","count":87}],"other_port_endpoints":28320,"service_types":[{"name":"HTTP","count":37542},{"name":"HTTPS","count":6656},{"name":"Unknown","count":70},{"name":"SMTP","count":7},{"name":"RDP","count":4}],"web_servers":[{"name":"Apache HTTP Server","count":31236},{"name":"Unidentified","count":6201},{"name":"lighttpd","count":2964},{"name":"nginx","count":2727},{"name":"Microsoft IIS","count":796},{"name":"Jetty","count":86},{"name":"Apache Tomcat","count":62},{"name":"OpenResty","count":56},{"name":"LiteSpeed","count":48},{"name":"Caddy","count":17},{"name":"Cloudflare","count":5}],"software":[{"name":"PHP","count":44099},{"name":"Apache HTTP Server","count":31241},{"name":"lighttpd","count":2964},{"name":"nginx","count":2727},{"name":"Microsoft IIS","count":800},{"name":"Jetty","count":86},{"name":"Apache Tomcat","count":62},{"name":"OpenResty","count":56},{"name":"LiteSpeed","count":48},{"name":"Caddy","count":17},{"name":"CouchDB","count":16},{"name":"Cloudflare","count":5}],"other_software_detections":3,"software_unit":"Family detections; PHP can coexist with a web server on one endpoint. These counts are not additive endpoint totals."},"generated_at":"2026-10-23T21:42:10.821Z","latest_observation":"2026-10-23T09:18:08.837018Z","scope":"Observed PHP IPs geolocated to Thailand by Shodan; not a census of every Thai server","unit":"Unique IP; not a count of physical servers, websites or organizations","assessment":"PHP2Shell version-range screening only; vendor backports, runtime/SAPI and configuration unverified. No exploit tests.","counts":{"total_ips":15865,"potential_ips":13438,"at_or_above_fix_ips":105,"unknown_ips":2322},"php_service_observations":44099,"domain_coverage":{"confirmed_suffix_ips":2503,"reported_suffix_ips":5342,"no_selected_suffix_ips":10523,"multiple_suffix_ips":194},"groups":{"confirmed":{"go.th":{"total_ips":43,"potential_ips":41,"at_or_above_fix_ips":0,"unknown_ips":2,"registered_domains":24,"potential_domains":23,"at_or_above_fix_domains":0,"unknown_domains":1},"or.th":{"total_ips":9,"potential_ips":9,"at_or_above_fix_ips":0,"unknown_ips":0,"registered_domains":9,"potential_domains":9,"at_or_above_fix_domains":0,"unknown_domains":0},"mi.th":{"total_ips":0,"potential_ips":0,"at_or_above_fix_ips":0,"unknown_ips":0,"registered_domains":0,"potential_domains":0,"at_or_above_fix_domains":0,"unknown_domains":0},"ac.th":{"total_ips":239,"potential_ips":214,"at_or_above_fix_ips":9,"unknown_ips":16,"registered_domains":23,"potential_domains":20,"at_or_above_fix_domains":0,"unknown_domains":3},"co.th":{"total_ips":2195,"potential_ips":2006,"at_or_above_fix_ips":6,"unknown_ips":183,"registered_domains":123,"potential_domains":118,"at_or_above_fix_domains":3,"unknown_domains":2},"in.th":{"total_ips":10,"potential_ips":10,"at_or_above_fix_ips":0,"unknown_ips":0,"registered_domains":9,"potential_domains":9,"at_or_above_fix_domains":0,"unknown_domains":0},"net.th":{"total_ips":8,"potential_ips":6,"at_or_above_fix_ips":0,"unknown_ips":2,"registered_domains":2,"potential_domains":2,"at_or_above_fix_domains":0,"unknown_domains":0}},"reported":{"go.th":{"total_ips":568,"potential_ips":548,"at_or_above_fix_ips":13,"unknown_ips":7,"registered_domains":180,"potential_domains":176,"at_or_above_fix_domains":1,"unknown_domains":3},"or.th":{"total_ips":109,"potential_ips":103,"at_or_above_fix_ips":1,"unknown_ips":5,"registered_domains":51,"potential_domains":48,"at_or_above_fix_domains":0,"unknown_domains":3},"mi.th":{"total_ips":5,"potential_ips":5,"at_or_above_fix_ips":0,"unknown_ips":0,"registered_domains":3,"potential_domains":3,"at_or_above_fix_domains":0,"unknown_domains":0},"ac.th":{"total_ips":1158,"potential_ips":1078,"at_or_above_fix_ips":27,"unknown_ips":53,"registered_domains":291,"potential_domains":281,"at_or_above_fix_domains":0,"unknown_domains":10},"co.th":{"total_ips":3331,"potential_ips":3091,"at_or_above_fix_ips":14,"unknown_ips":226,"registered_domains":447,"potential_domains":435,"at_or_above_fix_domains":3,"unknown_domains":9},"in.th":{"total_ips":185,"potential_ips":181,"at_or_above_fix_ips":1,"unknown_ips":3,"registered_domains":77,"potential_domains":77,"at_or_above_fix_domains":0,"unknown_domains":0},"net.th":{"total_ips":183,"potential_ips":167,"at_or_above_fix_ips":0,"unknown_ips":16,"registered_domains":6,"potential_domains":6,"at_or_above_fix_domains":0,"unknown_domains":0}}},"branches":[{"branch":"PHP 5.3","total_ips":1572,"potential_ips":1047,"at_or_above_fix_ips":0,"unknown_ips":525},{"branch":"PHP 4.3","total_ips":727,"potential_ips":0,"at_or_above_fix_ips":0,"unknown_ips":727},{"branch":"PHP 8.2","total_ips":1579,"potential_ips":1546,"at_or_above_fix_ips":33,"unknown_ips":0},{"branch":"PHP 5.4","total_ips":1961,"potential_ips":1924,"at_or_above_fix_ips":0,"unknown_ips":37},{"branch":"PHP 7.2","total_ips":897,"potential_ips":888,"at_or_above_fix_ips":0,"unknown_ips":9},{"branch":"PHP 5.5","total_ips":902,"potential_ips":282,"at_or_above_fix_ips":0,"unknown_ips":620},{"branch":"PHP 7.1","total_ips":423,"potential_ips":318,"at_or_above_fix_ips":0,"unknown_ips":105},{"branch":"PHP 5.6","total_ips":1731,"potential_ips":1379,"at_or_above_fix_ips":0,"unknown_ips":352},{"branch":"PHP 4.0","total_ips":214,"potential_ips":0,"at_or_above_fix_ips":0,"unknown_ips":214},{"branch":"PHP 5.2","total_ips":1198,"potential_ips":1184,"at_or_above_fix_ips":0,"unknown_ips":14},{"branch":"PHP 5.1","total_ips":401,"potential_ips":401,"at_or_above_fix_ips":0,"unknown_ips":0},{"branch":"PHP 7.4","total_ips":1688,"potential_ips":1679,"at_or_above_fix_ips":0,"unknown_ips":9},{"branch":"PHP 8.3","total_ips":895,"potential_ips":845,"at_or_above_fix_ips":50,"unknown_ips":0},{"branch":"PHP 8.4","total_ips":277,"potential_ips":258,"at_or_above_fix_ips":19,"unknown_ips":0},{"branch":"PHP 7.3","total_ips":819,"potential_ips":818,"at_or_above_fix_ips":0,"unknown_ips":1},{"branch":"PHP 8.0","total_ips":668,"potential_ips":665,"at_or_above_fix_ips":0,"unknown_ips":3},{"branch":"PHP 4.4","total_ips":155,"potential_ips":0,"at_or_above_fix_ips":0,"unknown_ips":155},{"branch":"PHP 5.0","total_ips":125,"potential_ips":125,"at_or_above_fix_ips":0,"unknown_ips":0},{"branch":"PHP 8.1","total_ips":464,"potential_ips":462,"at_or_above_fix_ips":0,"unknown_ips":2},{"branch":"PHP 8.5","total_ips":142,"potential_ips":122,"at_or_above_fix_ips":20,"unknown_ips":0},{"branch":"PHP 7.0","total_ips":135,"potential_ips":133,"at_or_above_fix_ips":0,"unknown_ips":2},{"branch":"PHP 6.0","total_ips":13,"potential_ips":0,"at_or_above_fix_ips":0,"unknown_ips":13},{"branch":"PHP 4.2","total_ips":1,"potential_ips":0,"at_or_above_fix_ips":0,"unknown_ips":1}],"dns_progress":{"checked_ips":16571,"total_ips":16571,"complete":true},"rules":{"cves":["CVE-2026-109618","CVE-2026-109619"],"cvss":{"version":"4.0","score":9.2},"fixed_versions":["8.2.35","8.3.36","8.4.27","8.5.12"],"reviewed":"2026-10-23","sources":["https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"]},"privacy":{"aggregate_only":true,"identifiers_in_response":false},"methodology":["IP with any potentially affected PHP service is counted once as potential.","IP with both at-fix and unknown services is unknown unless a potential version is observed.","At or above fix is not a security certification. Unknown includes unparseable, missing or outside-rule versions.","Confirmed domain groups require PTR plus successful forward resolution to the same IP.","Reported groups additionally include unverified Shodan hostnames/PTR; suffix is not proof of legal ownership.","An IP may belong to multiple suffix groups and PHP branches; their totals must not be summed.","No selected suffix means no saved evidence for these seven suffixes, not absence of hosted domains."]}