Enumerated phpinfo and .env secret-file paths on the kimberlymackdesignstudio.com vhost in a ~15s bu ...
show moreEnumerated phpinfo and .env secret-file paths on the kimberlymackdesignstudio.com vhost in a ~15s burst, all requests returned 403/404.
Target: HTTP 80, kimberlymackdesignstudio.com vhost (/phpinfo variants and /.env secret-file paths)
Seen: 2026-11-02 16:34 EST
- 16:34:44 GET /server-info.php 404 on kimberlymackdesignstudio.com vhost
- 16:34:41 GET /phpinfo 404 and 16:34:43 GET /debug.php 404
- 16:34:37 GET /sparkpost/.env 403 and 16:34:29 GET /next/.env 403 (secret-file enumeration)
- 16:34:25 GET /.env.example 403 and 16:34:45 GET /_environment 404
- ~167 requests in the hour, all 403/404, UA Chrome/131
show less
Microsoft (AS8075) IP enumerated ~50 PHP webshell filenames across a host and kimberlymackdesign.com ...
show moreMicrosoft (AS8075) IP enumerated ~50 PHP webshell filenames across a host and kimberlymackdesign.com between 15:15–15:16; all requests returned 404 with empty User-Agent.
Target: HTTP 80 web server, path enumeration of PHP webshells (wp_.php, ch3.php, ans.php, sc.php, wsoo.php, 1q2ase3.php) on vhosts a host and kimberlymackdesign.com
Seen: 2026-11-02 15:15-15:16 EST
- 20.217.184.185 sent GET /ch3.php and GET /sc.php HTTP/1.1, both 404, at 2026-11-02 15:16:20 with empty User-Agent
- 20.217.184.185 sent GET /ans.php HTTP/1.1 -> 404 at 2026-11-02 15:16:22 with empty User-Agent
- 20.217.184.185 enumerated ~50 distinct .php filenames (wp_.php, 1q2ase3.php, wsoo.php, rzadz3.php, class-meta-cache.php) between 15:15 and 15:16, each 404, on vhosts a host and kimberlymackdesign.com
show less
Abuse-100 DigitalOcean IP sent a single flow to the internet-facing HTTPS service that flagged Malic ...
show moreAbuse-100 DigitalOcean IP sent a single flow to the internet-facing HTTPS service that flagged Malicious Fingerprint at 15:26.
Target: HTTPS 443, inbound flow flagged Malicious Fingerprint
Seen: 2026-11-02 15:26 EST
- An inbound flow from 178.128.149.37 to HTTPS port 443 as 'Malicious Fingerprint' at 2026-11-02 15:26:59
- A permitted TCP flow from 178.128.149.37 to internet-facing :443 was seen reaching the service at 2026-11-02 15:26:53
show less
Flooded an internet-facing site with 50+ secret/.env/config file probes in ~3 seconds, all denied (4 ...
show moreFlooded an internet-facing site with 50+ secret/.env/config file probes in ~3 seconds, all denied (403/404).
Target: HTTPS :443, .env/secret/config file enumeration
Seen: 2026-11-02 13:34-13:35 EST
- 2026-11-02 13:34:59 GET /storage/logs/laravel.log -> 404
- 2026-11-02 13:34:58 GET /docker-compose.yml -> 404
- 2026-11-02 13:34:58 GET /.env.prod, /.env-sample, /.gitmodules -> 403
- 2026-11-02 13:34:57 GET /sentry.properties, /settings.json, /config.yaml, /secrets.json -> 404
- 2026-11-02 13:34:56 GET /.env.test, /v1/.env, /app/.env, /core/.env -> 403
- 50+ distinct secret/config/enumerated filenames within ~3 seconds, all denied 403/404
show less
Probed an internet-facing HTTP service with a single TCP SYN flagged as a malicious fingerprint, fro ...
show moreProbed an internet-facing HTTP service with a single TCP SYN flagged as a malicious fingerprint, from a high-abuse Google Cloud IP.
Target: HTTP :80
Seen: 2026-11-02 13:38 EST
- 2026-11-02 13:38:20 TCP SYN from 34.186.132.49:45432 -> port 80, 40-byte packet flagged as a malicious fingerprint
- 2026-11-02 13:38:15 same source port 45432 SYN to :80, no HTTP payload sent
show less
Probed an internet-facing site with /.git/config (denied 444) and a packet flagged as a possible exp ...
show moreProbed an internet-facing site with /.git/config (denied 444) and a packet flagged as a possible exploit, from a DigitalOcean IP.
Target: HTTP :80, /.git/config sensitive-file probe
Seen: 2026-11-02 13:45 EST
- 2026-11-02 13:45:28 GET /.git/config -> 444 on the internet-facing site
- 2026-11-02 13:45:37 Possible-Exploit flow from 161.35.170.105:52184 -> :80 flagged Emergency
- 2026-11-02 13:45:28 TCP SYN from 161.35.170.105:52184 -> port 80
show less
Attack traffic from this IP.
Seen: 2026-11-02 12:15 EST
- 2026-11-02 12:15:03 attacker sent a single ...
show moreAttack traffic from this IP.
Seen: 2026-11-02 12:15 EST
- 2026-11-02 12:15:03 attacker sent a single TCP SYN to destination port 80 (src port 57206)
- 2026-11-02 12:15:09 that flow from this source was classified as Malicious Fingerprint flow engine
show less
Attack traffic from this IP.
Seen: 2026-11-02 12:03 EST
- 2026-11-02 12:03:20 attacker sent a single ...
show moreAttack traffic from this IP.
Seen: 2026-11-02 12:03 EST
- 2026-11-02 12:03:20 attacker sent a single TCP SYN to destination port 80 (src port 46968)
- 2026-11-02 12:03:27 that flow from this source was classified as Malicious Fingerprint flow engine
show less
Keydrop.io scanning bot enumerating secret files (/.env, /.git/config) against the public web; singl ...
show moreKeydrop.io scanning bot enumerating secret files (/.env, /.git/config) against the public web; single flows denied.
Target: Public web HTTP 80 / HTTPS 443, GET /.env and /.git/config secret-file enumeration
Seen: 2026-11-02 04:34-12:32 EST
- 2026-11-02 04:34:58 Web server returned HTTP 444 (silent close) to GET /.env HTTP/1.1 from this source, user-agent Mozilla/5.0; Keydrop.io/1.0
- 2026-11-02 04:34:59 Web server returned HTTP 444 to GET /.git/config HTTP/1.1 from the same Keydrop.io bot
- 2026-11-02 12:32:24 flagged this source as Malicious Fingerprint -> HTTPS :443
show less
Probed the public web (files.thlok.tech) with a Next.js middleware auth-bypass probe (CVE-2025-29927 ...
show moreProbed the public web (files.thlok.tech) with a Next.js middleware auth-bypass probe (CVE-2025-29927); request silently closed.
Target: Public web HTTP 80, GET / on vhost files.thlok.tech (Next.js middleware auth-bypass probe)
Seen: 2026-11-02 12:37 EST
- 2026-11-02 12:37:30 IDS signature 1:2061026:1 "Next.js Middleware Authorization Bypass (CVE-2025-29927)" fired for source 207.175.248.243 -> target :80
- 2026-11-02 12:37:30 Web server silently closed the request (HTTP 444) to GET / with vhost files.thlok.tech from this source
show less
Ran a ~40-request burst of phpinfo and /.env* filename enumeration across our network's public web v ...
show moreRan a ~40-request burst of phpinfo and /.env* filename enumeration across our network's public web vhosts at 10:05, all denied 403/404. Google Cloud data-center IP with recent Hacking/Brute-Force reports.
Target: HTTP 80, secret/config files (/.env, /.env.* and phpinfo variants) on vhosts kimberlymackdesign.com and a host
Seen: 2026-11-02 10:05 EST
- 10:05:00-08: ~40 rapid GET requests for phpinfo variants (phpinfo.php, info.php, p.php, _environment, _profiler/phpinfo...) and secret files across kimberlymackdesign.com and a host vhosts
- 10:05:03 GET /shop/.env HTTP/1.1 -> 403, 10:05:06 GET /brevo/.env -> 403, 10:05:08 GET /phpinfo.php -> 404 (same host, same enumeration, UA Mozilla/5.0 Chrome 131)
- All requests returned 403/404 with nothing leaked, nothing forwarded as exploit
show less
Single TCP SYN passes denied at the edge. Abuse-100 internet-census host.
Seen: 2026-11-02 10:37-10: ...
show moreSingle TCP SYN passes denied at the edge. Abuse-100 internet-census host.
Seen: 2026-11-02 10:37-10:38 EST
- 10:37:48 Emergency Malicious-Fingerprint flow 45.156.128.84:17045 -> port 443
- 10:38:15 Critical Remote-to-Local Insecure Flow 45.156.128.84:20192 -> port 443
- 10:37:40 and 10:38:10 firewall: single TCP SYN pass from 45.156.128.84 to port 443 (no block; single-flow only)
show less
Single TCP SYN pass denied at the edge. Chilean data-center host with recent port-scan reports.
Seen ...
show moreSingle TCP SYN pass denied at the edge. Chilean data-center host with recent port-scan reports.
Seen: 2026-11-02 10:42 EST
- 10:42:08 Critical Malicious-Fingerprint flow 64.176.10.199:52693 -> port 443
- 10:42:02 firewall: single TCP SYN pass from 64.176.10.199 to port 443 (no block; single-flow only)
show less
Repeated WordPress comment-spam POSTs to the WP blog vhost returning 500, preceded by a REST post-en ...
show moreRepeated WordPress comment-spam POSTs to the WP blog vhost returning 500, preceded by a REST post-enumeration. Known wp-comments-post.php spammer.
Target: HTTPS 443 a host WordPress wp-comments-post.php comment endpoint
Seen: 2026-11-02 10:48 EST
- 10:48:13, 10:48:20, 10:48:31 POST /wp-comments-post.php HTTP/2.0 -> 500 (WordPress backend error)
- 10:48:13 GET /index.php?rest_route=/wp/v2/posts&per_page=100&_fields=... -> 200 (post enumeration before spam)
show less
Google Cloud datacenter IP enumerating WordPress install paths (wp-includes/wlwmanifest.xml) and xml ...
show moreGoogle Cloud datacenter IP enumerating WordPress install paths (wp-includes/wlwmanifest.xml) and xmlrpc.php against the public web vhost; all requests returned 403/301.
Target: HTTPS 443 vhost, GET //wp-includes/wlwmanifest.xml enumeration and //xmlrpc.php?rsd
Seen: 2026-11-02 09:23 EST
- 09:23:14 GET //xmlrpc.php?rsd HTTP/2.0 -> 403 vhost
- 09:23:15-09:23:18 GET //cms, //site, //test, //shop, //wp1, //wp, //wordpress, //blog, //web wp-includes/wlwmanifest.xml HTTP/2.0 -> 301s, enumerating WordPress install paths
show less
Enumerated ~30 secret-path URLs (/.env, //config/.env, //api/.env, /.production, /.local) over ~7 se ...
show moreEnumerated ~30 secret-path URLs (/.env, //config/.env, //api/.env, /.production, /.local) over ~7 seconds, all returning 403.
Target: HTTPS 443 /web-app secret-file enumeration (/^.*\.env$, /.production, /.local) vhost
Seen: 2026-11-02 07:08 EST
- 07:08:35 GET /.env HTTP/2.0 403 vhost from 34.91.214.200
- 07:08:38 GET //config/.env HTTP/2.0 403 from 34.91.214.200
- 07:08:39 GET //api/.env HTTP/2.0 403 from 34.91.214.200
- 07:08:40 GET //v1/.env and //v2/.env HTTP/2.0 403 from 34.91.214.200
- 07:08:41 GET //laravel/.env and //administrator/.env HTTP/2.0 403 from 34.91.214.200
show less
Repeated TCP flows to the internet-facing web server on :80 matched the network sensor's Malicious-F ...
show moreRepeated TCP flows to the internet-facing web server on :80 matched the network sensor's Malicious-Fingerprint rule.
Target: HTTP 80 internet-facing web server
Seen: 2026-11-02 06:06 EST
- 2026-11-02 06:06:59 TCP flow from 35.206.189.197:45494 to the web server on :80 flagged Malicious-Fingerprint
- 2026-11-02 02:44:26 TCP SYN from 35.206.189.197:45494 to :80 at the edge (3 total hits over 24h)
- 2026-11-02 04:19:37 second Malicious-Fingerprint flow from 35.206.189.197:45478 to the web server on :80
show less
389 reports) matched the Malicious-Fingerprint rule against the internet-facing web server on :443 a ...
show more389 reports) matched the Malicious-Fingerprint rule against the internet-facing web server on :443 and probed ha.thlok.tech.
Target: HTTPS 443 internet-facing web server; GET / on ha.thlok.tech
Seen: 2026-11-02 06:02 EST
- 2026-11-02 06:02:29 TCP flow from 106.63.26.155:5098 to the web server on :443 flagged Malicious-Fingerprint
- 2026-11-02 06:12:17 second Malicious-Fingerprint flow from 106.63.26.155:22637 to the web server on :443
- 2026-11-02 06:12:16 GET / HTTP/1.1 -> 403 on ha.thlok.tech host header from 106.63.26.155
show less
Enumeration of .env secret files and phpinfo info-leak probes against the kimberlymackdesign.com and ...
show moreEnumeration of .env secret files and phpinfo info-leak probes against the kimberlymackdesign.com and a host vhosts; every request denied 403/404.
Target: HTTPS 443 / HTTP 80, vhosts kimberlymackdesign.com and a host; /.env.example, /web/.env, /_environment, /test/phpinfo.php
Seen: 2026-11-02 06:48 EST
- 2026-11-02 06:48:26 GET /.env.example HTTP/1.1 -> 403 on kimberlymackdesign.com host header
- 2026-11-02 06:48:34 GET /web/.env HTTP/1.1 -> 403 on kimberlymackdesign.com host header
- 2026-11-02 06:48:42 GET /_environment HTTP/1.1 -> 404 on kimberlymackdesign.com host header
- 2026-11-02 06:48:40 GET /test/phpinfo.php HTTP/1.1 -> 404 on kimberlymackdesign.com host header
show less
.env/config enumeration and a CVE-2025-29927 Next.js probe against internet-facing ports.
Target: HT ...
show more.env/config enumeration and a CVE-2025-29927 Next.js probe against internet-facing ports.
Target: HTTP 80/443: CVE-2025-29927 header and .env/config enumeration
Seen: 2026-11-02 05:24-05:35 EST
- 05:24:52 TCP/1:2061026 'ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)' from 34.6.120.56:48002 -> port 80
- 05:24:52 TCP SYN pass from 34.6.120.56:48002 to port 80; 05:24:52 TCP SYN pass from 34.6.120.56:50282 to port 443
- 05:35:16 GET /files../.env HTTP/1.1 (attacker request)
- 05:35:16 GET /static//.env HTTP/1.1 (attacker request)
show less
Path-traversal and .env enumeration against the ai.thlok.tech vhost, all denied 400/403.
Target: HTT ...
show morePath-traversal and .env enumeration against the ai.thlok.tech vhost, all denied 400/403.
Target: HTTP 80, vhost ai.thlok.tech: ../../../../proc/self/environ, /files../.env, /.output/server/index.mjs, /api/fs/read path traversal
Seen: 2026-11-02 05:54 EST
- 05:54:22 GET /static/../../../a/../../../../proc/self/environ HTTP/1.1 -> 400 (IDS web attack)
- 05:54:25 GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/1.1 -> 400
- 05:54:20 GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env HTTP/1.1 -> 403
- 05:54:19 GET /files../.env HTTP/1.1 -> 403; GET /.output/server/index.mjs -> 403; all env/config probes denied
show less
Repeated .env/config/secret-file and path-traversal enumeration against internet-facing vhosts, all ...
show moreRepeated .env/config/secret-file and path-traversal enumeration against internet-facing vhosts, all denied 403/404.
Target: HTTP 443, vhosts a host/a host: /.env, /core/.env, /wp-admin/.env, /%2eenv, /userfiles path traversal
Seen: 2026-11-02 05:24 EST
- 05:24:37 GET /.a host HTTP/2.0 -> 403 upstream
- 05:24:38 GET /userfiles?path=../../../../.env HTTP/2.0 -> 403 (IDS web attack)
- 05:24:37 GET /%2eenv HTTP/2.0 -> 403
- 05:24:41 GET /core/.env HTTP/2.0 -> 403
- 05:24:39 GET /settings/developer HTTP/2.0 -> 404; sweep of env/config/secret paths, every request denied
show less
Single TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerpri ...
show moreSingle TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerprint.
Target: Port 80 (internet-facing web service)
Seen: 2026-11-02 05:59 EST
- 05:59:57 TCP SYN pass from 35.206.187.243:45531 to port 80 at the edge firewall
- 06:00:02 Emergency Malicious Fingerprint flow 35.206.187.243:45531 -> port 80
show less
Single TCP SYN probe to the internet-facing web service on port 443, flagged as a Malicious Fingerpr ...
show moreSingle TCP SYN probe to the internet-facing web service on port 443, flagged as a Malicious Fingerprint.
Target: Port 443 (internet-facing web service)
Seen: 2026-11-02 05:41 EST
- 05:41:18 TCP SYN pass from 35.210.246.75:45548 to port 443 at the edge firewall
- 05:41:26 Critical Malicious Fingerprint flow 35.210.246.75:45548 -> port 443
show less
Single TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerpri ...
show moreSingle TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerprint.
Target: Port 80 (internet-facing web service)
Seen: 2026-11-02 05:04 EST
- 05:04:05 TCP SYN pass from 95.214.54.159:45240 to port 80 at the edge firewall
- 05:04:11 Critical Malicious Fingerprint flow 95.214.54.159:45240 -> port 80
show less
Port Scan
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.