IP address - 34.38.25.51; Date - 2026-08-08; UTC time - 12:43:03; Requests blocked: 226; User agent: ...
show moreIP address - 34.38.25.51; Date - 2026-08-08; UTC time - 12:43:03; Requests blocked: 226; User agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:[email protected], Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36; Distributed web vulnerability scanning campaign originating from this GCP IP address (Belgium region). The actor is executing aggressive automated path probing to harvest sensitive files, environment configs, and framework endpoints (e.g., /actuator, /_profiler/open, /phpinfo.php, /.ssh/id_rsa, and multiple .env variations).
The attacker is employing advanced User-Agent Spoofing, concatenating forged Anthropic bot strings (Claude-User) with standard Chrome Linux user-agents to bypass WAF filters.; Blocked by - Cloudflare Waf: Ray_ID: a27e9ac63b01d13a; Waf Cloudflare log samples:
.env, .env.*, *.env
.git-credentials, .ssh/*, id_rsa, id_ed25519, host.key
wp-config.php*, config.php.bak
show less
IP address - 34.86.2.136; Date - 2026-08-08; UTC time - 16:33:33; Requests blocked: 534; User agent: ...
show moreIP address - 34.86.2.136; Date - 2026-08-08; UTC time - 16:33:33; Requests blocked: 534; User agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:[email protected]; Blocked by - Cloudflare Waf; Mass vulnerability scanning and web application attack originating from this GCP IP address. The actor is performing aggressive path traversal and credential harvesting attempts, targeting sensitive files and configuration backups such as /.env, /wp-config.php.old, /.git-credentials, /Dockerfile, and /.streamlit/secrets.toml. Furthermore, the attacker is actively using User-Agent Spoofing, falsely masquerading as an Anthropic bot (Claude-User/1.0; +mailto:[email protected]) to bypass WAF rules.; Waf Cloudflare log samples:
/env.js
Ray_ID a27febf63de024ca
/staging/.env
Ray_ID a27febf488a524ca
/.env.docker
Ray_ID a27febf488a124ca
/docker/.env
Ray_ID a27febf4480224ca
/src/.env
a27febf40f6c24ca
/.streamlit/secrets.toml
/wp-config.php.old
show less
IP - 5,100,255,168; Date: 2026-08-02; UTC Time - 18:42:34; User-agent: Mozilla/5.0 (X11; Linux x86_6 ...
show moreIP - 5,100,255,168; Date: 2026-08-02; UTC Time - 18:42:34; User-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
Chrome/96.0.4664.45 Safari/537.36; Automated directory brute-forcing/fuzzing using HEAD HTTP requests targeting WordPress paths, backups, and archived directories (/wordpress, /wp-old, /old, /2026). Spoofed User-Agent (Chrome 96 on Linux). Host shows high malicious reputation (Spamhaus Spam Emitter, BitDefender Phishing) and runs vulnerable IIS/ASP.NET stack. All malicious requests were challenged/blocked by WAF.
url path:
HEAD /wp
HEAD /Wp
HEAD /WP
HEAD /wordpress
HEAD /WordPress
HEAD /wp-old
HEAD/old
HEAD /oldsite
HEAD /backup
HEAD /test
HEAD /2017
HEAD /2018
HEAD /2019
HEAD /2020
HEAD /2024
HEAD /2025
HEAD /2026
show less
IP Blocked - 144.172.110.122; Date - 2026-08-03; UTC Time - 10:32:17; Hostile web vulnerability scan ...
show moreIP Blocked - 144.172.110.122; Date - 2026-08-03; UTC Time - 10:32:17; Hostile web vulnerability scanning for sensitive environment files (.env, .env.local, .env.bak, /backup/.env) targeting Laravel applications. High-frequency automated requests blocked by WAF. Host is flagged for active C2/Malware activity (win.gootkit/xswkit) on Spamhaus/GreyNoise. Sample URI requests: GET /.env, GET /.env.local, GET /backup/.env. Sample waf logs
/.env.old
Ray ID a254a8536ddd170b
/.env.bak
a254a850ac1b5a75
/.env.local
a254a84d3c5b170b
/.env.backup
a254a84b6f800900
/.env
a254a848cca469c1
/mix-manifest.json
a254a8449fdfa102
/sanctum/csrf-cookie
a254a840efd75a75
/backup/.env
a254a8349c1fe4ec
/.env.old
a254a82b6b62f554
GET
/.env.bak
a254a821ef59c8d2
GET
/.env.local
a254a81dfa3ee9e0
GET
/.env.backup
a254a81af91217c1
GET
/.env
a254a817c97d27d8
GET
/mix-manifest.json
a254a81499ea24e5
GET
/sanctum/csrf-cookie
a254a810de73e172
GET
/
a254a80dab6bf472
show less
IP - 103.65.236.209; Date; 2026-07-22; UTC Time - 19:59:47; Blocked by - Cloudflare WAF - managed ru ...
show moreIP - 103.65.236.209; Date; 2026-07-22; UTC Time - 19:59:47; Blocked by - Cloudflare WAF - managed rules - Ray ID - a1f507233ab1fd2d; WP2Shell exploit attempts blocked by Cloudflare managed rules; URL path: /wp-json/batch/v1; /readme.html; /?rest_route=/batch/v1;
show less
IP Blocked - 20.206.105.145; Incident date: 2026-07-18; Incident time: 02:32:35; Blocked by - Cloudf ...
show moreIP Blocked - 20.206.105.145; Incident date: 2026-07-18; Incident time: 02:32:35; Blocked by - Cloudflare WAF - IP and ASN blocking rules and active bot combat mode; Blocked requests - 162; Highly active and aggressive automated scanner hosted on Microsoft Azure, executing rapid-fire PHP fuzzing and backdoor hunting. The host generated 162 malicious probing requests within a 12-second window.
The bot targeted arbitrary PHP scripts, structural CMS directories, and timestamped campaign files (e.g., /j260624_13.php, /wp-temp.php) looking for active web shells. Broken URL formatting (double/triple slashes) indicates automated script execution. Active global threat confirmed by recent Abuse.ch and VirusTotal OSINT intelligence (historical financial phishing node). All requests successfully mitigated by Cloudflare WAF.
; Samples of 19 GET requests: /j260624_13.php; /fpwch.php; /green3.php; ///admin.php; /file52.php; /177.php; /koala.php; /crgio.php; /wp-admin/css/colors/modern/; /wp-temp.php; /100.php;
show less
IP Blocked - 173.239.196.162; Blocked requests - 289; Incident date - 2026-07-18; UTC time - 09:54:0 ...
show moreIP Blocked - 173.239.196.162; Blocked requests - 289; Incident date - 2026-07-18; UTC time - 09:54:01; Follow-up automated CMS scanning wave from the same host block (coordinated with 173.239.196.161). The bot executed 289 aggressive directory brute-forcing and vulnerability probing requests in a short window.
It specifically targeted historical WordPress upload subdirectories, premium theme structures for known RCE exploits (/wp-json/bricks/v1/render_element/), exposed backup folders (/backup/, /.trash7309/), and legacy Joomla extensions. All 289 automated requests were successfully mitigated and blocked by the WAF.
Sample Targeted Paths:
- /wp-json/bricks/v1/render_element/
- /wp-content/uploads/2026/
- /.trash7309/
- /wp-content/plugins/shell/
- /components/com_jea/views/form/tmpl/
show less
IP Blocked - 173.239.196.161; Blocked requests - 976; Incident date - 2026-07-18; UTC time - 09:53:4 ...
show moreIP Blocked - 173.239.196.161; Blocked requests - 976; Incident date - 2026-07-18; UTC time - 09:53:45; Aggressive automated WordPress backdoor hunting and web shell fuzzing. The host executed a high-density attack generating 976 malicious requests within a 3-minute window. The scanner systematically targeted sensitive CMS directories searching for active web shells, malicious remnants, and file managers (such as WSO Shell, Alfa Shell, and TinyFileManager). All 976 automated probing requests were successfully mitigated and blocked by the WAF.
Sample Targeted Paths:
- /wp-content/wso.php
- /wp-content/ALFA_DATA/alfacgiapi/bypass.php
- /tinyfilemanager/tinyfilemanager.php
- /wp-admin/css/bolt.php
- /wp-includes/sitemaps/providers/ultra.php
- /wp-content/plugins/pwnd/adminfus.php
-/.alf.php
-/file.php%20
-/chosen.php%20
show less
IP - 20.151.225.23; Incident Date: 2026-07-18; UTC time - 16:21:44; Blocked requests - 110; Blocked ...
show moreIP - 20.151.225.23; Incident Date: 2026-07-18; UTC time - 16:21:44; Blocked requests - 110; Blocked by - Cloudflare WAF; Host hosting malicious infrastructure on Azure Cloud, performing automated fuzzing, vulnerability scanning, and backdoor hunting targeting richardsonserra.com.
The bot executed a rapid burst of requests targeting sensitive WordPress directories and searching for common web shell filenames/arbitrary PHP scripts to exploit the server. Cross-referenced OSINT indicators (Abuse.ch, GreyNoise, VirusTotal) confirm this host is an active botnet node/spam emitter with multiple global abuse reports in the last few hours.
Targeted Paths:
- /wp-file.php
- /sid3.php
- /wp-includes/PHPMailer/
- /wp-content/plugins/WordPressCore/
- /wp-includes/SimplePie/index.php
- /wp-content/themes/admin.php
- /plugin.php
show less
IP - 185.177.72.56; Incident Date: 2026-07-18; UTC time - 06:44:23; Requests blocked - 3.98K; User A ...
show moreIP - 185.177.72.56; Incident Date: 2026-07-18; UTC time - 06:44:23; Requests blocked - 3.98K; User Agent - curl/8.7.1; High-intensity automated vulnerability scanning and RCE. The logs show explicit attempts to exploit known RCE vulnerabilities (such as PHPUnit CVE-2017-9841) and path traversal to extract sensitive configuration data (.env, backup.sql, wp-config.php, and SSH/AWS keys). Traffic was mitigated and blocked by Cloudflare WAF.
Sample Targeted Paths:
- /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
- /files/..%2fbackend%2f.env
- /media/..%2fbackup.sql
- /img/..%2f.aws%2fconfig
- /old/..%2fwp-config.php
- /..%252fprivkey.pem
- /wp-admin/install.php
show less
IP Blocked - 91.193.232.136; Incident date: 2026-07-13; UTC time: 15:02:04; Blocked by: Cloudflare W ...
show moreIP Blocked - 91.193.232.136; Incident date: 2026-07-13; UTC time: 15:02:04; Blocked by: Cloudflare WAF; Two unauthorized login attempts; GET URL path: /wp-login.php;
show less
This host is conducting automated, high-volume directory brute-forcing (fuzzing) and active scanning ...
show moreThis host is conducting automated, high-volume directory brute-forcing (fuzzing) and active scanning (MITRE ATT&CK T1190) targeting multiple web application frameworks, config files, and credentials.
In a single burst, the IP generated over 1,860 rapid-fire parallel requests, attempting to probe and exploit known vulnerabilities.
Targeted paths identified in this campaign include:
- Critical Credential Leaks & Env Files: /.env, /backend/.env, /public/.env, /.aws/config, /.ssh/id_rsa, /.dockercfg
- Remote Code Execution (RCE): /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
- Framework probes: Next.js (/__nextjs_action, /_next/image), Laravel, GraphQL (/v4/playground, /graphql/console), Elasticsearch, Node.js (/var/task/package.json)
- CI/CD & Deploy configs: /.github/workflows/deploy.yml, /docker-compose.prod.yml
User-Agents utilized: "curl/8.7.1" and "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". All requests were successfully mitigated at the Edge (WAF Cloudflare)
show less
Cloudflare custom firewall blocked an aggressive automated vulnerability scan from 20.226.26.5 ; The ...
show moreCloudflare custom firewall blocked an aggressive automated vulnerability scan from 20.226.26.5 ; The host generated multiple rapid GET requests in a 4-second window, scanning the root directory for potential PHP backdoors, web shells, and malicious entry points (e.g., /wp-cliner.php, /wp-firewall.php, /666.php, /reyna.php, /ma1.php). All malicious requests were strictly blocked by the WAF.
Log Sample:
- 2026-07-13T13:10:07Z | GET /wp-cliner.php | Action: block
- 2026-07-13T13:10:07Z | GET /reyna.php | Action: block
- 2026-07-13T13:10:06Z | GET /w1px.php | Action: block
- 2026-07-13T13:10:04Z | GET /wp-firewall.php | Action: block
- 2026-07-13T13:10:03Z | GET /666.php | Action: block
show less
Bad Web BotExploited HostWeb App AttackHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.