The IP address 52.202.49.233, belonging to Amazon AWS (AS14618), performed a series of automated req ...
show moreThe IP address 52.202.49.233, belonging to Amazon AWS (AS14618), performed a series of automated requests strongly indicating web application scanning and attempts to access secrets and credentials. The observed pattern corresponds to enumeration attacks and sensitive file discovery, with a high probability of originating from automated bots or scanning frameworks.
## 2. Date and Time
2026-08-29; 11:11:20 BRT
Blocked request: 57;
## 3. Attack Vectors and Traffic Samples
1. Sensitive File Enumeration
Attempts to access files that typically contain tokens, keys, credentials, and environment variables:
/.env
/.env.bak
/api/.env
/.docker/config.json
/.github/.env
/credentials.json
/serviceAccountKey.json
/.boto
2. Administrative Panel Scanning
Requests to common administrative endpoints:
/dashboard
/console
/panel
/account/login
3. Application Structure Reconnaissance
Access to directories and files typical of frameworks:
/api/
/dashboard
/console
show less
1. Incident Description
A high-intensity automated scanning campaign (involving vulnerability scann ...
show more1. Incident Description
A high-intensity automated scanning campaign (involving vulnerability scanning and brute-force attempts) was detected targeting the WordPress-based web infrastructure (`richardsonserra.com`). The hostile actor executed hundreds of malicious requests within a short timeframe, probing for common administrative paths and known plugin/theme vulnerabilities, as well as attempting to inject backdoors and web shells (such as WSO-type scripts). The traffic was successfully intercepted and blocked by mitigation mechanisms and the perimeter firewall, resulting in no impact on data or system integrity. Global SOC records indicate that the source IP is part of a large-scale, automated persistent threat infrastructure.
## 2. Date and Time
* **Start / Incident Monitoring Window:** August 28, 2026, at approximately 04:39 BRT.
* **Backdoor / Web Shell Scanning:**
* `GET /wso.php`
* `GET /files.php`
* `GET /classwithtostring.php`
* `GET /Sanskrit.php`
* **Intrusion Attempts on CMS Paths
show less
# Incident Report: Malicious IP Scanning and Automated Probing
## 1. Incident Overview
* **Attac ...
show more# Incident Report: Malicious IP Scanning and Automated Probing
## 1. Incident Overview
* **Attacker IP Address:** `34.139.4.186`
* **ASN & Provider:** `AS396982` - Google LLC (Google Cloud infrastructure)
* **Incident Window / Timestamp:** August 27, 2026, from 20:58:31 to 20:58:35 BRT
* **Total Requests Logged:** 330 requests within a 24-hour window (100% mitigated/blocked by edge security)
* **Threat Reputation Context:** Flagged globally across multiple threat intelligence platforms (VirusTotal, GreyNoise, Fortinet, and MalwareURL) as an active scanning and probing node.
## 2. Attack Vectors & Techniques (TTPs)
The source IP executed an automated, high-frequency brute-force reconnaissance and path traversal scan. The behavior mimics automated vulnerability scanners looking for exposed environment secrets, administrative backups, configuration files, and private keys.
show less
Malicious IP Profile: 185.177.72.67 Date: 2026-08-27; UTC Time: 06:51:20; Blocked Requests: 3.18k; B ...
show moreMalicious IP Profile: 185.177.72.67 Date: 2026-08-27; UTC Time: 06:51:20; Blocked Requests: 3.18k; Blocked by: Waf Cloudflare; IP 185.177.72.67 performed scans and attempted exploitation on multiple services (Docker, Kubernetes, Grafana, MLflow, WordPress, Next.js, Supabase, PHP Unit, etc.).
It also attempts to access sensitive credentials and configuration files (.env, AWS, GCP, Firebase, Mailgun, SES, Postmark).
Observed Behaviors & Attack Vectors:
- Vulnerability & Port Scanning: Active probing of Kubernetes endpoints (ports 10250, 10256), SSH (port 22), and NTP.
- Information Gathering / Credential Harvesting: Automated high-frequency requests targeting sensitive configuration files (.env, gcloud.json, firebase.json, db.sql) and API keys (AWS, SendGrid, Mailgun, Postmark, Stripe).
- Application Exploitation: Attempts to exploit RCE vectors via PHPUnit eval-stdin.php paths and vulnerable CMS plugins using automated tools (curl/8.7.1).
show less
Incident Summary:
On 2026-08-22 UTC Time:21:46:01, the IP address 52.141.19.25, belonging to AS8075 ...
show moreIncident Summary:
On 2026-08-22 UTC Time:21:46:01, the IP address 52.141.19.25, belonging to AS8075 (Microsoft Corporation) and geolocated in South Korea. Blocked by: WAF Cloudflare; Malicious automated vulnerability scanning (fuzzing/directory probing). The host issued 108 rapid HTTP GET requests in less than 15 seconds targeting non-existent PHP backdoors, webshells, and sensitive endpoints (e.g., /wp-0.php, /BDKR28WP.php, /zoo1.php, /new.php). All requests presented an empty User-Agent header and were dropped at the edge WAF layer. Likely compromised Azure instance operating as an automated scanner/botnet node.
[2026-08-22 18:46:00 BRT] Blocked IP: 52.141.19.25 | ASN: AS8075 | Country: KR | Method: GET | Path: /wp-0.php | Protocol: HTTP/1.1 | User-Agent: "" | Action: Blocked
[2026-08-22 18:46:00 BRT] Blocked IP: 52.141.19.25 | ASN: AS8075 | Country: KR | Method: GET | Path: /k.php | Protocol: HTTP/1.1 | User-Agent: "" | Action: Blocked
show less
IP - 34.252.74.149; Blocked requests: 188; Blocked by - Cloudflare WAF; UTC Time: 21:51:36; User-Age ...
show moreIP - 34.252.74.149; Blocked requests: 188; Blocked by - Cloudflare WAF; UTC Time: 21:51:36; User-Agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; Attack type: Automated attack blocked by Cloudflare WAF, characterized by an extensive search for environment information and "phpinfo.php" files scattered across dozens of subdirectories and alternative paths. Targeted exhaustive dictionary-style scan to locate the `phpinfo()` utility across multiple paths:`/phpinfo`, `/phpinfo.php`, `/_phpinfo.php`, `/old_phpinfo.php`, `/php-info.php`, `/phpversion.php`, `/info`, `/p.php`, `/debug.php`, `/test.php`. - Mapping of sensitive subdirectories: `/admin/phpinfo.php`, `/dev/phpinfo.php`, `/test/phpinfo.php`,`/tmp/phpinfo.php`, `/old/phpinfo.php`, `/public/phpinfo.php`, `/smtp/phpinfo.php`, `/webmail/phpinfo.php`, `/hosting/phpinfo.php`, `/cpanel/phpinfo.php`, `/mail/phpinfo.php`.
show less
IP address - 34.38.25.51; Date - 2026-08-08; UTC time - 12:43:03; Requests blocked: 226; User agent: ...
show moreIP address - 34.38.25.51; Date - 2026-08-08; UTC time - 12:43:03; Requests blocked: 226; User agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:[email protected], Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36; Distributed web vulnerability scanning campaign originating from this GCP IP address (Belgium region). The actor is executing aggressive automated path probing to harvest sensitive files, environment configs, and framework endpoints (e.g., /actuator, /_profiler/open, /phpinfo.php, /.ssh/id_rsa, and multiple .env variations).
The attacker is employing advanced User-Agent Spoofing, concatenating forged Anthropic bot strings (Claude-User) with standard Chrome Linux user-agents to bypass WAF filters.; Blocked by - Cloudflare Waf: Ray_ID: a27e9ac63b01d13a; Waf Cloudflare log samples:
.env, .env.*, *.env
.git-credentials, .ssh/*, id_rsa, id_ed25519, host.key
wp-config.php*, config.php.bak
show less
IP address - 34.86.2.136; Date - 2026-08-08; UTC time - 16:33:33; Requests blocked: 534; User agent: ...
show moreIP address - 34.86.2.136; Date - 2026-08-08; UTC time - 16:33:33; Requests blocked: 534; User agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:[email protected]; Blocked by - Cloudflare Waf; Mass vulnerability scanning and web application attack originating from this GCP IP address. The actor is performing aggressive path traversal and credential harvesting attempts, targeting sensitive files and configuration backups such as /.env, /wp-config.php.old, /.git-credentials, /Dockerfile, and /.streamlit/secrets.toml. Furthermore, the attacker is actively using User-Agent Spoofing, falsely masquerading as an Anthropic bot (Claude-User/1.0; +mailto:[email protected]) to bypass WAF rules.; Waf Cloudflare log samples:
/env.js
Ray_ID a27febf63de024ca
/staging/.env
Ray_ID a27febf488a524ca
/.env.docker
Ray_ID a27febf488a124ca
/docker/.env
Ray_ID a27febf4480224ca
/src/.env
a27febf40f6c24ca
/.streamlit/secrets.toml
/wp-config.php.old
show less
IP - 5,100,255,168; Date: 2026-08-02; UTC Time - 18:42:34; User-agent: Mozilla/5.0 (X11; Linux x86_6 ...
show moreIP - 5,100,255,168; Date: 2026-08-02; UTC Time - 18:42:34; User-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
Chrome/96.0.4664.45 Safari/537.36; Automated directory brute-forcing/fuzzing using HEAD HTTP requests targeting WordPress paths, backups, and archived directories (/wordpress, /wp-old, /old, /2026). Spoofed User-Agent (Chrome 96 on Linux). Host shows high malicious reputation (Spamhaus Spam Emitter, BitDefender Phishing) and runs vulnerable IIS/ASP.NET stack. All malicious requests were challenged/blocked by WAF.
url path:
HEAD /wp
HEAD /Wp
HEAD /WP
HEAD /wordpress
HEAD /WordPress
HEAD /wp-old
HEAD/old
HEAD /oldsite
HEAD /backup
HEAD /test
HEAD /2017
HEAD /2018
HEAD /2019
HEAD /2020
HEAD /2024
HEAD /2025
HEAD /2026
show less
IP Blocked - 144.172.110.122; Date - 2026-08-03; UTC Time - 10:32:17; Hostile web vulnerability scan ...
show moreIP Blocked - 144.172.110.122; Date - 2026-08-03; UTC Time - 10:32:17; Hostile web vulnerability scanning for sensitive environment files (.env, .env.local, .env.bak, /backup/.env) targeting Laravel applications. High-frequency automated requests blocked by WAF. Host is flagged for active C2/Malware activity (win.gootkit/xswkit) on Spamhaus/GreyNoise. Sample URI requests: GET /.env, GET /.env.local, GET /backup/.env. Sample waf logs
/.env.old
Ray ID a254a8536ddd170b
/.env.bak
a254a850ac1b5a75
/.env.local
a254a84d3c5b170b
/.env.backup
a254a84b6f800900
/.env
a254a848cca469c1
/mix-manifest.json
a254a8449fdfa102
/sanctum/csrf-cookie
a254a840efd75a75
/backup/.env
a254a8349c1fe4ec
/.env.old
a254a82b6b62f554
GET
/.env.bak
a254a821ef59c8d2
GET
/.env.local
a254a81dfa3ee9e0
GET
/.env.backup
a254a81af91217c1
GET
/.env
a254a817c97d27d8
GET
/mix-manifest.json
a254a81499ea24e5
GET
/sanctum/csrf-cookie
a254a810de73e172
GET
/
a254a80dab6bf472
show less