![[DEEP RESEARCH] The bad IP was never the Actor.](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/size/w600/2026/06/zz-2.png)
deep
[DEEP RESEARCH] The bad IP was never the Actor.
A bad IP can be accurate and still tell the wrong story.
deep
A bad IP can be accurate and still tell the wrong story.
![[DEEP RESEARCH] BadIIS Isn’t Enough: The IIS Module + HTTP Fingerprints That Catch SEO-Fraud Cloaking](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/size/w600/2026/02/z-2.png)
uat-8099
*Vendors are naming slices of the same IIS SEO fraud problem differently. This summary aligns those labels into one unified hunt surface and shows how to separate UAT-8099/WEBJACK from other BadIIS-style activity using concrete host and HTTP fingerprints.*