Automated exploit attempts and vulnerability scanning originating from AS48715 (Sefroyek Pardaz Engi ...
show moreAutomated exploit attempts and vulnerability scanning originating from AS48715 (Sefroyek Pardaz Engineering PJSC, Iran).
The IP performed aggressive enumeration and targeted attack payloads against a WordPress site, specifically hitting the newly discovered 'wp2shell' exploit vector.
Attack details from logs:
- Timestamp: 2026-09-07 04:46:58 - 04:46:59 BRT
- Methods: GET / POST
- Request URIs: /wp-json/, /?rest_route=/, /?rest_route=/batch/v1 (WordPress REST API Batch vulnerability exploit chain)
- User-Agent: Empty (Blank User-Agent, indicative of malicious automated scanners)
Infrastructure intelligence confirms open ports (22, 25, 80, 443, 3306) associated with cPanel/hosting infrastructure (idigitalhost.com). Please investigate this node for compromise or abuse.
show less
Summary of Abuse:
This IP (34.44.197.32) belonging to Google Cloud (AS396982) has been actively exe ...
show moreSummary of Abuse:
This IP (34.44.197.32) belonging to Google Cloud (AS396982) has been actively executing automated vulnerability scans, port scans (TCP 443, 8080, 8443), and targeted web application attacks. Telemetry and WAF logs confirm attempts at unauthorized secret harvesting, specifically probing for sensitive configuration files (.aws/credentials, /.env.local, google-service-account.json) and management endpoints (/actuator, /management/env, /server-status). The node uses a disguised browser User-Agent to bypass basic defenses and is part of a broader automated reconnaissance campaign. Observed Attack Vectors & Signatures:
Cloud & Environment Credential Harvesting:
/.aws/credentials (Global telemetry confirms successful hits against vulnerable external targets yielding HTTP 200)
/.env, /.env.local?raw, /.env.development?import&raw, /@fs/app/.env
google-service-account.json, push_config.json
Management & Diagnostic Probing:
/actuator, /management/env, /server-status
/graphql (POST requests)
show less
IP 104.198.172.126 was observed conducting an automated scanning and secret-enumeration attack,
in ...
show moreIP 104.198.172.126 was observed conducting an automated scanning and secret-enumeration attack,
including attempts to access environment files, configuration artifacts, and diagnostic endpoints
across multiple frameworks (Laravel, WordPress, Spring Boot). Although not currently listed in major
blacklists, the activity pattern is consistent with malicious scanning bots or compromised cloud infrastructure.
All requests were successfully mitigated by Cloudflare WAF; no traffic reached the origin.
* Environment & Secret Harvesting
/.env, /.ENV, /.env.local, /.env.production, /.env.bak, /.env.dev
/%2eenv, /.env;.png, //.env
* Framework & Diagnostic Endpoint Probing
Spring Boot: /actuator/env, /actuator/configprops
Laravel: /_ignition/health-check, /storage/logs/laravel.log
Generic: /internal/config
* Backup & Artifact Enumeration
wp-config.php.bak
wp-config.php.swp
* Scanner Fingerprinting & WAF Probing
User-Agent: crusader-worker/1.0
Path probe: /crusader-404-probe
show less
This IP was observed performing automated scanning for
leaked credentials and exposed administrati ...
show moreThis IP was observed performing automated scanning for
leaked credentials and exposed administrative endpoints, indicating
a host compromised with active malware and engaging in aggressive,
multi-vector scanning. last_seen: 2026-09-05 13:59:21 UTC
Dozens of samples extracted from the logs reveal a battery of surgical tests executed in rapid succession on September 5th:
* Configuration and Secret Scanning:
Exhaustive searches for environment files (.env, config/.env.php, storage/.env,
sendgrid.env, firebase.json), microservice configuration files (yaml, json,
gradle.properties), and backups (.env.prod.bak).
* Sensitive Endpoint and Debug Probing:
Attempts to access dashboards and diagnostic tools (
/phpinfo.php, /_profiler/open, /graphql/console, /wp-json, /panel).
* Path Traversal / LFI Attempts:
Sophisticated requests—such as /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ—attempting
directory traversal to read operating system environment variables.
show less
Attack Vectors / Incident Details:
* Targeted Paths: Systematic mass scanning and probing for WordP ...
show moreAttack Vectors / Incident Details:
* Targeted Paths: Systematic mass scanning and probing for WordPress installation and administrative paths (e.g., /wp-admin/install.php, /shop/wp-admin/install.php, /backup/wp-admin/install.php, /blog/wp-admin/install.php).
* Behavioral Pattern: Automated web application probing, vulnerability scanning, and generation of excessive HTTP response errors (40X status codes / brute-force mapping).
* Anomalous Infrastructure Indicators: Open port 4444 (associated with reverse shells/tuneling), self-signed/invalid SSL certificate (CN=invalid2.invalid), and a history as a spam emitter.
* User-Agent Spoofing: Utilizing outdated browser signatures (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36...) to blend malicious automated requests with legacy traffic.
Timestamp (UTC): 2026-09-05T20:26:30Z (approximate window matching active multi-vector web app probing).
show less
This IP address—35.237.82.164—was observed scanning for
phpinfo/debug endpoints and attempting to ...
show moreThis IP address—35.237.82.164—was observed scanning for
phpinfo/debug endpoints and attempting to exfiltrate secrets.
It also attempted to access `.env` files in over 30 directories,
as well as credential files (e.g., `key.json`, `sa.json`,
`application_default_credentials.json`). Additionally, the IP
was observed attempting to exploit an RCE vulnerability in React
(CVE-2025-55182) via POST requests. All observed exploitation a
ttempts were blocked by the Cloudflare WAF.Fully mitigated by Cloudflare
WAF — 0 requests reached origin.
* Source Code & Staging Exposure:
Probing for version control exposure (/.git/config) and diagnostic debugging
scripts (/phpinfo.php, /qa/phpinfo.php, /includes/phpinfo.php, /wp-admin/phpinfo.php,
/server-info.php).
* Remote Code Execution (RCE) Attempts:
Delivery of targeted POST requests aiming to exploit known framework vulnerabilities,
specifically matching React RCE signatures (CVE-2025-55182).
show less
Automated, high-frequency reconnaissance scan targeting the exposure of sensitive version control
...
show moreAutomated, high-frequency reconnaissance scan targeting the exposure of sensitive version control
files ('.git/config') across various root and subdirectory paths. The behavior is consistent with a
preliminary scan for credential harvesting (source code, API keys, database credentials) via Git metadata.
No successful exfiltration occurred; the activity was fully blocked by the Cloudflare edge firewall before
reaching the origin infrastructure. IP Address:** `136.119.184.122`
* **ASN / Provider: Google LLC
* **Geolocation: United States
* **First Observed:** 2026-09-02 08:06:59 UTC
* **Last Observed:** 2026-09-02 08:07:00 UTC
* **Total Requests Observed: 24 HTTP GET requests withing a <1s window
* **User-Agent:** `crusader-worker/1.0`
* **Action Taken:** 100% Blocked at Cloudflare Edge WAF; /public/.git/config
/html/.git/config
/site/.git/config
/www/.git/config
/wordpress/.git/config
/htdocs/.git/config
/api/.git/config
/app/.git/config
/var/www/.git/config
show less
Automated WordPress reconnaissance and path fuzzing attack against richardsonserra.com on 2026-08-29 ...
show moreAutomated WordPress reconnaissance and path fuzzing attack against richardsonserra.com on 2026-08-29 (04:44 BRT). Automated scanner probing for /xmlrpc.php and wlwmanifest.xml across multiple subdirectories (/shop/, /wordpress/, /cms/, /test/, /wp/, /sito/, /2019/, /media/, /wp1/) to detect WordPress versions and prepare for exploitation. IP: 35.243.225.131 (Google LLC - AS396982).
show less
Automated high-speed web application scanning and cloud credential harvesting attack against richard ...
show moreAutomated high-speed web application scanning and cloud credential harvesting attack against richardsonserra.com on 2026-08-29 (19:04 BRT). 279 malicious requests blocked by Cloudflare WAF in 6 seconds. Target paths include GCP/Firebase credentials (/google-key.json, /gcp-sa.json, /firebase-adminsdk.json, /google-credentials.json), environment files (/.env.yaml, /.env.backup, /react/.env, /config/app/.env), Git config (/.git/config), and PHP info disclosure (/core/phpinfo.php, /wp-admin/phpinfo.php, /_profiler/phpinfo). Originating IP: 34.95.189.96 (Google LLC - AS396982).; “/google-key.json”
“/firebase-adminsdk.json”
“/application_default_credentials.json”
“/google-credentials.json”
“/gcp-sa.json”
show less
IP - IP 34.139.77.106; Blocked Requests: 317; Fully blocked by Cloudflare WAF; Date: 2026-08-29; UTC ...
show moreIP - IP 34.139.77.106; Blocked Requests: 317; Fully blocked by Cloudflare WAF; Date: 2026-08-29; UTC Time: 21:21;
High-severity automated attack blocked by the Cloudflare edge firewall. Attempts to access multiple credential and secret files, including service-account.json, gcp-service.json, gcp-key.json, keys/service-account.json, secrets.env, id_ed25519, host.key, auth.json, and account/_payload.json. Attempts to exploit debug frameworks and endpoints such as /telescope/requests (Laravel), /app_dev.php and /_profiler/open (Symfony), /wp-json and /wp-config.php.bak (WordPress), as well as /debug/pprof/cmdline (Go). The IP performed directory traversal attempts (/@fs/../.env, /@fs/.env) and API enumeration (/api/v1/env, /api/v2/settings, /api/openapi.json).
“/telescope/requests”
“/_profiler/open”
“/app_dev.php”
“/api/v1/env”
“/config.json.js”
“/@fs/../.env”
“/host.key”
“/secrets.env”
“/id_ed25519”
“/service-account.json”
“/gcp-service.json”
“/keys/service-account.json”
show less
IP address: 34.45.248.203; Blocked requests: 260;
Operating System: Linux (Shodan), Open port: 22 ( ...
show moreIP address: 34.45.248.203; Blocked requests: 260;
Operating System: Linux (Shodan), Open port: 22 (SSH),
Tags: cloud; Date: 2026-08-29; UTC Time: 18:47:44; Description: High-speed automated scanning/fuzzing attack against the web application, generating 260 malicious HTTP GET/POST requests within a span of just 21 seconds; Attack vectors:
* Credential & Cloud Key Harvesting: Active search for GCP service keys and credentials within .json and .env files in development/infrastructure directories.
* Information Disclosure / Diagnostic Probing: Fuzzing of over 20 paths containing diagnostic scripts (/phpinfo.php, /_profiler/phpinfo, /pinfo.php, /debug.php).
* Source Code Exposure (Git Leakage): Attempted arbitrary reading of version control configuration files (/.git/config).
* Path & Subdirectory Fuzzing: Probing of administrative routes, test environments, and microservices (/administrator/, /uat/, /microservice/, /gateway/, /webmail/).
show less
Attacker IP: 136.66.89.235; Blocked requests: 928; Fully blocked by Cloudflare WAF; Date: 2026-08-29 ...
show moreAttacker IP: 136.66.89.235; Blocked requests: 928; Fully blocked by Cloudflare WAF; Date: 2026-08-29; UTC Time: 12:15:38; Attack duration: 2 minutes; High-intensity scanning attack targeting credential exfiltration, internal system file reading, path traversal, and Vite/Node SSR exploitation via the /@fs/ prefix:
Use of encoded traversal to escape the project root:
/@fs/..%252f..%252f..%252f..%252f..%252froot/.env
/@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ;
Attempts to read internal system files:
/@fs/etc/nginx/nginx.conf
/@fs/etc/apache2/apache2.conf
/@fs/proc/self/environ
/@fs/proc/self/cmdline
/@fs/etc/passwd
Attempts to access credentials from multiple providers:
/@fs/root/.aws/credentials
/@fs/home/ubuntu/.azure/credentials
/@fs/app/gcp-credentials.json
/@fs/root/.oci/config
/@fs/root/.ovh.conf
/@fs/root/.vultr-cli.yaml
/@fs/root/.config/gcloud/credentials.db
/@fs/home/ec2-user/.aws/config
show less
The IP address 52.202.49.233, belonging to Amazon AWS (AS14618), performed a series of automated req ...
show moreThe IP address 52.202.49.233, belonging to Amazon AWS (AS14618), performed a series of automated requests strongly indicating web application scanning and attempts to access secrets and credentials. The observed pattern corresponds to enumeration attacks and sensitive file discovery, with a high probability of originating from automated bots or scanning frameworks.
## 2. Date and Time
2026-08-29; 11:11:20 BRT
Blocked request: 57;
## 3. Attack Vectors and Traffic Samples
1. Sensitive File Enumeration
Attempts to access files that typically contain tokens, keys, credentials, and environment variables:
/.env
/.env.bak
/api/.env
/.docker/config.json
/.github/.env
/credentials.json
/serviceAccountKey.json
/.boto
2. Administrative Panel Scanning
Requests to common administrative endpoints:
/dashboard
/console
/panel
/account/login
3. Application Structure Reconnaissance
Access to directories and files typical of frameworks:
/api/
/dashboard
/console
show less
1. Incident Description
A high-intensity automated scanning campaign (involving vulnerability scann ...
show more1. Incident Description
A high-intensity automated scanning campaign (involving vulnerability scanning and brute-force attempts) was detected targeting the WordPress-based web infrastructure (`richardsonserra.com`). The hostile actor executed hundreds of malicious requests within a short timeframe, probing for common administrative paths and known plugin/theme vulnerabilities, as well as attempting to inject backdoors and web shells (such as WSO-type scripts). The traffic was successfully intercepted and blocked by mitigation mechanisms and the perimeter firewall, resulting in no impact on data or system integrity. Global SOC records indicate that the source IP is part of a large-scale, automated persistent threat infrastructure.
## 2. Date and Time
* **Start / Incident Monitoring Window:** August 28, 2026, at approximately 04:39 BRT.
* **Backdoor / Web Shell Scanning:**
* `GET /wso.php`
* `GET /files.php`
* `GET /classwithtostring.php`
* `GET /Sanskrit.php`
* **Intrusion Attempts on CMS Paths
show less
# Incident Report: Malicious IP Scanning and Automated Probing
## 1. Incident Overview
* **Attac ...
show more# Incident Report: Malicious IP Scanning and Automated Probing
## 1. Incident Overview
* **Attacker IP Address:** `34.139.4.186`
* **ASN & Provider:** `AS396982` - Google LLC (Google Cloud infrastructure)
* **Incident Window / Timestamp:** August 27, 2026, from 20:58:31 to 20:58:35 BRT
* **Total Requests Logged:** 330 requests within a 24-hour window (100% mitigated/blocked by edge security)
* **Threat Reputation Context:** Flagged globally across multiple threat intelligence platforms (VirusTotal, GreyNoise, Fortinet, and MalwareURL) as an active scanning and probing node.
## 2. Attack Vectors & Techniques (TTPs)
The source IP executed an automated, high-frequency brute-force reconnaissance and path traversal scan. The behavior mimics automated vulnerability scanners looking for exposed environment secrets, administrative backups, configuration files, and private keys.
show less