This IP (35.196.128.16 – AS396982 Google LLC) is part of an active botnet and is infected with multi ...
show moreThis IP (35.196.128.16 – AS396982 Google LLC) is part of an active botnet and is infected with multiple banking malware families (Tinba, Ranbyus, Nymaim), confirmed by sinkhole detections. It is listed on Spamhaus XBL and flagged as malware/suspicious by VirusTotal.
Between Oct 15–17 2026, this IP performed more than 385 malicious requests against my server, including:
Local File Inclusion attempts (proc/self/environ)
Path Traversal (../../)
Attempts to read .env, .aws/credentials, .ssh/id_rsa, service-account.json
Attempts to access private keys (ssl/server.key, id_dsa, id_ecdsa)
Attempts to exploit internal APIs (/api/fs/read, /api/system/fileView)
Spoofed user-agents (Googlebot, Bingbot, Applebot, GPTBot, ClaudeBot, GrokBot, PerplexityBot, etc.)
Scanning of admin routes (/admin, /manage, /studio)
Scanning of login routes (/login, /sign-in, /account/login)
Cloudflare blocked all attempts. This IP is clearly compromised and actively used for automated attacks.
show less
Scanning and Exfiltration of Environment Files (.env): Exhaustive probing for various sensitive conf ...
show moreScanning and Exfiltration of Environment Files (.env): Exhaustive probing for various sensitive configuration files across multiple directories (e.g., /.env, /.env.local, /.env.production, /docker/.env, /backend/.env, /pipeline/.env). Exfiltration of Cloud and DevOps Credentials: Targeted attempts to access infrastructure and cloud-based keys and secrets, including AWS credentials (/root/.aws/credentials), Google Cloud configuration files (/gcp-service.json, /serviceAccountKey.json), Vault tokens (/.vault-token), Git history (/.git-credentials), and private SSH keys. Directory Traversal and Path Traversal: Use of directory traversal techniques involving encoding and special characters (e.g., /@fs/..%252f, ../.., /....//..../) to attempt to read sensitive internal operating system files, such as /proc/self/environ and /proc/self/cmdline. Remote Code Execution (RCE) Attempts: POST requests directed at generic application endpoints CVE-2025-55182;
show less
The IP address 34.11.47.82 conducted high-intensity automated scanning and fuzzing campaigns against ...
show moreThe IP address 34.11.47.82 conducted high-intensity automated scanning and fuzzing campaigns against our web infrastructure. Malicious activity focused on structured perimeter reconnaissance probes, attempts to exfiltrate configuration files and sensitive credentials, and vulnerability scanning across web application directories: Scanning and Credential/ .env File Leakage: Exhaustive attempts to read sensitive environment and configuration files across multiple directories (e.g., /.env.production, /project/.env, /.env.local, /.env.keys). Search for Infrastructure and DevOps Keys: Probes targeting SSH keys and cloud/orchestration credential files (e.g., /id_rsa, /id_ecdsa, /@fs/home/ubuntu/.aws/credentials, /gcp-key.json, /.terraform/terraform.tfstate). Injection and Remote Code Execution (RCE) Attempts: POST requests targeting endpoints and PHP interpreters with remote and local file inclusion payloads (allow_url_include / auto_prepend_file). Use of Spoofed Signatures:
show less
This IP address 35.214.94.244 conducted a sophisticated, automated reconnaissance and web applicatio ...
show moreThis IP address 35.214.94.244 conducted a sophisticated, automated reconnaissance and web application attack campaign against our production infrastructure. The activity combined exhaustive directory enumeration, credential/secret harvesting, and active exploitation attempts targeting modern framework vulnerabilities.; Remote Code Execution (RCE) Exploitation Attempt:
Executed malicious POST requests targeting React Server Components to exploit CVE-2025-55182 (Unsafe Deserialization RCE Attempt).
Environment & Credential Leakage Scanning: Enumerated multiple application paths and subdirectories for hidden configuration files and sensitive credentials, including: /.env, /.env.local, /.env.production, /stage/.env, /worker/.env, /queue/.env, /kafka/.env, /gitlab/.env, /brevo/.env, /notifications/.env, /administrator/.env, /node/.env, /crm/.env, /resources/.env, /prestashop/.env, /storage/.env, /core/app/.env
Cloud provider secrets: /gcp-credentials.json, /gcp-key.json, Git repository
show less
Between September 23 and 27, 2026, the WAF infrastructure recorded a persistent volume of over 2,062 ...
show moreBetween September 23 and 27, 2026, the WAF infrastructure recorded a persistent volume of over 2,062
blocked malicious requests originating from IP address 34.95.222.235, which is allocated to Google
Cloud Platform (GCP). The observed tactical behavior indicated an automated campaign involving
vulnerability scanning and data exfiltration (specifically credential harvesting); ATTACK VECTORS
* Sensitive file scanning — .env, .git/config, .aws/credentials, .ssh/id_ed25519, serviceAccountKey.json, secrets.yml, Dockerfile, docker-compose.yml
* Path traversal exploitation — @fs/proc/self/environ, ../.env, %2e%2e%2f — attempts to access system files via Vite/Node.js;
* Debug/admin endpoint exploration — /actuator, /phpinfo.php, /info.php, /_profiler, /console, /swagger.json, /openapi.json;
* RCE/PHP exploitation — cgi-bin/php-cgi.exe with auto_prepend_file=php://input — remote code execution attempt
* AI/LLM endpoints — /functionRouter, /api/designer/v1/file-content, /read-document, /mcp, /exec-py;
show less
Brute-ForceBad Web BotWeb App AttackPort ScanHacking
The IP address has been observed conducting an automated campaign involving
large-scale vulnerabil ...
show moreThe IP address has been observed conducting an automated campaign involving
large-scale vulnerability scanning and data exfiltration, actively orchestrated
by a malicious actor. The IP belongs to the Google Cloud Platform cloud infrastructure and is located in the United States.
Between September 23 and 25, 2026, the volume of requests initiated by this actor
escalated significantly (402 requests on the 23rd, 498 on the 24th, and a jump to
975 requests on the 25th), demonstrating persistence in mapping and compromising
the perimeter; ATTACK VECTORS
• Environment and Configuration File Exfiltration: (/app/.env, /server/.env, /.next/.env, /@fs/.env, among others).
• System Key and Credential Harvesting: (/id_rsa, /id_dsa, /id_ecdsa, authorized_keys); (/.aws/config, /.docker/config.json, Rails master keys such as /config/master.key).• Exploitation of Frameworks and Sensitive Endpoints: (__vite_rsc_findSourceMapURL); (/actuator/mappings, /actuator/loggers)
show less
A malicious actor conducting an aggressive, automated campaign of vulnerability scanning and path en ...
show moreA malicious actor conducting an aggressive, automated campaign of vulnerability scanning and path enumeration originating from cloud infrastructure (Google Cloud), focusing on: massive exfiltration of environment and configuration files (.env, .env.development), (2) attempts to steal private keys and system access data (e.g., SSH keys such as id_ecdsa), targeted exploitation of endpoints associated with development frameworks and tools, probing for administration panels. The activity was successfully mitigated through custom rules managed at the edge (Cloudflare). 🔹 ATTACK VECTORS
* Sensitive file discovery (.env, .env.local, .env.development, .env.dev, .env.php.bak, config.yaml, config.toml, config.env, config/master.key, secrets.yml)
* Credential harvesting (AWS, SendGrid, Brevo, Mailjet, SES, Stripe, OpenAI, Anthropic, Twilio)
* SSH & Docker key exposure (.ssh/authorized_keys, .docker/config.json, .bash_profile)
* Repository leakage (.gitconfig, .vscode/launch.json)
show less
IP 45.139.104.176 (AS399979 – 49.3 Networking LLC, Bulgaria) is a confirmed multi‑malware infected r ...
show moreIP 45.139.104.176 (AS399979 – 49.3 Networking LLC, Bulgaria) is a confirmed multi‑malware infected residential proxy used for automated credential harvesting, environment file leakage, PHP diagnostic probing, repository exposure attempts, and RCE testing. The host is compromised by several banking trojans and botnet loaders and is actively used for reconnaissance and exploitation across multiple targets; Observed Attack Vectors:
Credential harvesting: /secrets/*.env, /mailjet.env, /brevo.env, /sendgrid.env, /credentials.xml
Admin tool probing: /dbadmin/, /adminer.php, /phpmyadmin/config.inc.php
Repository exposure: /.git/config
Backup access attempts: /backup.sql, /backup/sendgrid.json
Config leakage: /values.yaml, /helm/values.yaml, /config.xml
RCE attempts: Cloudflare flagged payloads mapped to CVE‑2025‑55182 (React RCE)
User-Agent spoofing: UnifiedPaths/1.0
show less
IP 34.181.176.62 (AS396982 – Google LLC) engaged in a high-density automated vulnerability
scan ta ...
show moreIP 34.181.176.62 (AS396982 – Google LLC) engaged in a high-density automated vulnerability
scan targeting multiple web‑application paths. The activity included forced browsing,
environment file enumeration, PHP diagnostic probing, WordPress REST abuse, and repeated
attempts to access .git repositories. The attack resembles early‑stage zero‑day reconnaissance
behavior and was fully mitigated by WAF controls; ATTACK VECTORS
* Environment Variable Enumeration (*Environment Leaks*):
- /.env, /.env_copy, /.env.swp, /.env.live, /.env.staging, /aws/.env, /mysql/.env, /redis/.env, /magento/.env, /config/.env
* Server Configuration Mapping / PHP Info:
- /phpinfo.php, /i.php, /p.php, /test.php, /phpversion.php, /info, /admin/phpinfo.php, /debug.php
* Version Control / Repository Probing:
- /.git/config
* Attempted Exploitation of Specific Vulnerabilities / RCE:
- POST requests directed at the root simulating active exploits (blocked by the WAF under the React RCE rule - CVE-2025-55182).
show less
IP 34.47.57.95 (AS396982 – Google LLC, Canada) performed a high-density automated vulnerability scan ...
show moreIP 34.47.57.95 (AS396982 – Google LLC, Canada) performed a high-density automated vulnerability scan
against a public‑facing perimeter. The activity included forced browsing, environment file enumeration,
cloud credential harvesting, PHP diagnostic probing, and RCE payload delivery. All requests were fully
mitigated by WAF Cloudflare controls; ATTACK VECTORS: * Cloud Credential Hunting:
- /credentials.json, /service-account.json, /gcp-credentials.json, /google-key.json
* Environment Variable Enumeration (*Environment Leaks*):
- /.env, /.env.bak, /.env.example, /uat/.env, /jenkins/.env, /production/.env, /terraform/.env
* Server Configuration Mapping / PHP Info:
- /phpinfo.php, /i.php, /p.php, /test.php, /_profiler/phpinfo
* Attempted Exploitation of Specific Vulnerabilities / RCE:
- Triggering payloads targeting known flaws (e.g., attempt mapped by WAF under CVE-2025-55182 / React RCE).
* Exposed Version Control Repositories:
- /.git/config
show less
An unidentified actor operating from cloud infrastructure (Google Cloud, AS396982)
is conducting a ...
show moreAn unidentified actor operating from cloud infrastructure (Google Cloud, AS396982)
is conducting automated web vulnerability scanning against multiple targets.
The attacker uses wordlists to enumerate sensitive files (.env, SSH credentials,
AWS keys, Kubernetes tokens, terraform.tfstate, CI/CD files), exploits path traversal
vulnerabilities in Vite/Spring Actuator frameworks, and accesses exposed debug endpoints.
A distinctive signature is the systematic rotation of spoofed User-Agents mimicking AI crawlers
(ClaudeBot, GPTBot, DeepSeekBot, PerplexityBot, Qwenbot, Bytespider, etc.
The observed rate was ~9.3 requests/second, totaling ~900 requests over ~96 seconds,
utilizing HTTP/2 and HTTP/1.1 with GET (94%), POST (6%), and DELETE (0.2%) methods.
No requests reached the origin of the observed target (100% blocked by the Cloudflare WAF).
Date: 2026-09-17 20:22:00 UTC
show less
This IP address from Google Cloud infrastructure was detected conducting automated web application r ...
show moreThis IP address from Google Cloud infrastructure was detected conducting automated web application reconnaissance, vulnerability scanning, and aggressive API probing against our domain. The actor systematically probed for sensitive configuration files, cloud credentials (AWS, Firebase), private keys, and environment files, while also attempting destructive or unauthorized actions using the DELETE HTTP method on sensitive API endpoints. All requests were intercepted and blocked at the edge by our WAF and security rules.
show less
This IP address from Google Cloud infrastructure (Belgium) was detected conducting automated web app ...
show moreThis IP address from Google Cloud infrastructure (Belgium) was detected conducting automated web application reconnaissance and vulnerability scanning against our domain. The actor systematically probed for sensitive configuration files, environment variables, credentials, and deployment artifacts. All requests were intercepted, challenged, and blocked at the edge by our WAF and security rules.
show less
This IP address was detected conducting automated web application scanning and reconnaissance agains ...
show moreThis IP address was detected conducting automated web application scanning and reconnaissance against our infrastructure. The actor executed a high volume of requests targeting arbitrary sensitive files, configuration paths, debug endpoints, and backend vulnerabilities (such as /wp-config.old, /config/.env.php, /dist../.env, /phpinfo.php, and /application.properties) in an attempt to discover exposed configuration or source files. All requests were intercepted and blocked at the edge by our WAF and security rules.
show less
This IP address was detected conducting automated web application scanning and reconnaissance agains ...
show moreThis IP address was detected conducting automated web application scanning and reconnaissance against our WordPress infrastructure. The actor executed a burst of requests targeting arbitrary non-existent PHP utility scripts, backdoors, and shell filenames (such as /ebkid.php, /gigi.php, /min.php, /ebkid.php, /z70.php, /av.php, /mac.php, and /blacks.php) in an attempt to discover exposed or vulnerable files. All requests lacked a valid user-agent and were blocked at the edge by our WAF.
show less
This IP address was observed conducting a high-frequency automated web application attack and vulner ...
show moreThis IP address was observed conducting a high-frequency automated web application attack and vulnerability scan against our WordPress infrastructure. The actor executed hundreds of POST requests targeting the WordPress REST API batch endpoints (such as /wp-json/batch/v1, /wp/v2/posts/, and path variations like /wordpress/wp-json/batch/v1) in an attempt to exploit application logic vulnerabilities and batch-processing flaws. Additionally, the scan included probes for administrative panels, login paths (/wp-login.php, /admin, /dashboard, /login), and directory structure enumeration. Identified Attack Vectors
Abuse of the WordPress Batch API: Massive bursts of POST requests targeting `/wp-json/batch/v1` and subdirectory variations (e.g., `/wordpress/wp-json/batch/v1`, `/blog/wp-json/batch/v1`) to attempt to exploit batch processing or injection vulnerabilities.
Scanning of Administration and Authentication Routes: (e.g., `/wp-login.php`, `/admin`, `/dashboard`)
show less
This IP address (belonging to Contabo GmbH / AS51167) was observed conducting an aggressive, high-fr ...
show moreThis IP address (belonging to Contabo GmbH / AS51167) was observed conducting an aggressive, high-frequency automated vulnerability scan and webshell injection probe against our WordPress infrastructure. The actor performed a rapid sequential brute-force scan of common utility scripts, backdoor tools, and malicious PHP files (including FoxWSOv1.php, c99.php, xleet.php, symlink.php, mailer.php, and single-character path probes like /a.php through /z.php and /1.php through /9.php). This activity matches automated bot behavior searching for compromised endpoints or pre-existing webshells for lateral movement.
show less
Date and UTC Time: 2026-09-15T11:43:22.000Z; This IP address (belonging to Google Cloud / AS396982) ...
show moreDate and UTC Time: 2026-09-15T11:43:22.000Z; This IP address (belonging to Google Cloud / AS396982) was observed executing automated vulnerability probing and web application scanning against our infrastructure. The actor performed a high-frequency sequence of requests targeting sensitive configuration files, environment variables, backup paths, and system debugging endpoints (such as /.env, /.env.local, /storage/.env, /panel/.env, /.git/config, and /mail/phpinfo.php). This activity matches automated reconnaissance and path probing patterns typically associated with malicious web scanners. Identified Attack Vectors
Sensitive File Scanning (Information Disclosure): Repeated attempts to access server environment and configuration files:
/.env and directory-specific variations (/storage/.env, /portal/.env, /tools/.env, /dev/.env, /build/.env, /core/.env, /psnlink/.env, /panel/.env, /.env.local)
/.git/config, /mail/phpinfo.php and /server-info.php;
show less
This IP address (belonging to Google Cloud / AS396982) was observed conducting automated vulnerabili ...
show moreThis IP address (belonging to Google Cloud / AS396982) was observed conducting automated vulnerability scanning, web application probing, and reconnaissance against our infrastructure. The attacker performed a high-frequency burst of requests targeting sensitive application files, backup files, and environment variables (such as /.env, /secrets.env, /config.json, /key.json, and /.git/config). Additionally, the actor actively engaged in User-Agent spoofing, masquerading as legitimate search engines and AI crawlers (including Baiduspider, Claude-SearchBot, Googlebot, and Perplexitybot) to bypass perimeter defenses. Identified Attack Vectors – Reconnaissance and Port Scanning: Active scanning of standard web server ports (80, 443, 8080, 8443). Sensitive File Scanning (Information Disclosure / LFI): Mass attempts to access environment configuration files and secrets (e.g., `/.env` and variations like `/.env.local`, `/.env.development`, `/secrets.env`;
show less
Automated scanner originating from IP 34.84.222.92 (AS396982 — Google Cloud, Tokyo/Japan) performing ...
show moreAutomated scanner originating from IP 34.84.222.92 (AS396982 — Google Cloud, Tokyo/Japan) performing a massive, coordinated scan against the domain www.richardsonserra.com. The attacker executed 754 requests within a window of approximately 90 seconds, combining multiple attack vectors simultaneously: SSRF for cloud metadata exfiltration (similar to the Capital One incident), path traversal to access credential files, command injection, SQL injection, and administrative panel enumeration.
/api/redirect?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F
/api/proxy?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Finfo
/proxy?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F;
Date: 2026-09-13 UTC Time: 17:50:45
show less
SUMMARY
An automated reconnaissance and exploitation campaign was conducted by IP 34.86.163.181, or ...
show moreSUMMARY
An automated reconnaissance and exploitation campaign was conducted by IP 34.86.163.181, originating from Google Cloud (AS396982).
The attacker uses spoofed AI crawler user-agents (KimiBot, GPTBot, Claude-SearchBot, Qwenbot, Hunyuan, xAI-Grok, Applebot, Google-Extended)
as a masquerading and evasion technique.
The campaign’s objective is to:
* Discover and exfiltrate environment variables, cloud credentials, and DevOps artifacts
* Probe filesystem exposure via /@fs/
* Enumerate authentication endpoints
* Identify build metadata and internal application structure
* Map exposed APIs for potential exploitation
The pattern matches large-scale automated scanners sweeping thousands of websites simultaneously.
* Last observed: 2026-09-12T09:16:01.000Z UTC
* Total requests (single target): 86 in ~60 seconds
show less