Swept secret/config files and phpinfo probes against the public a host vhost; all attempts returned ...
show moreSwept secret/config files and phpinfo probes against the public a host vhost; all attempts returned 404.
Target: HTTPS 443 vhost a host; secret/config files /.env variants and phpinfo probes
Seen: 2026-11-02 23:24-23:25 EST
- 2026-11-02 23:25:15-16 EST: GET /mailing/.env, /bulk/.env and /brevo/.env from 35.187.146.247 vhost returned 404
- 2026-11-02 23:25:26 EST: GET /webroot/index.php/_environment from 35.187.146.247 returned 404, host=a host
- 2026-11-02 23:25:20 EST: GET /phpinfo.php from 35.187.146.247 returned 404, host=a host
show less
Swept secret/config files and phpinfo probes against the public a host vhost; all attempts denied at ...
show moreSwept secret/config files and phpinfo probes against the public a host vhost; all attempts denied at the proxy.
Target: HTTPS/HTTP 443 vhost a host; secret/config files /.env variants and phpinfo probes
Seen: 2026-11-02 23:37-23:38 EST
- 2026-11-02 23:38:17-19 EST: GET /mailing/.env, /bulk/.env and /transactional/.env from 35.201.212.172 vhost returned 403 (correctly denied)
- 2026-11-02 23:38:20-24 EST: rapid sweep of phpinfo.php probes (webmail, hosting, cpanel, php-info, debug.php, p.php) returned 404, host=a host
show less
The probe was denied.
Target: HTTP 80; /.git/HEAD metadata reconnaissance
Seen: 2026-11-02 23:49 EST ...
show moreThe probe was denied.
Target: HTTP 80; /.git/HEAD metadata reconnaissance
Seen: 2026-11-02 23:49 EST
- 2026-11-02 23:49:25 EST: Possible Exploit alert — 45.130.203.170:22171 -> port 80
- 2026-11-02 23:49:24 EST: firewall passed 45.130.203.170:22171 -> port 80, confirming the SYN reached the edge only
show less
Enumerated secret and config files at 2026-11-02 ~22:22 EST, hitting ~25 paths including many .env v ...
show moreEnumerated secret and config files at 2026-11-02 ~22:22 EST, hitting ~25 paths including many .env variants, config files, credentials, docker-compose.yml and Dockerfile; responses were mostly 404 with a few 403s.
Target: HTTPS 443 vhost; secret/config files /.env and variants, /config/*, /credentials, /.netrc, /docker-compose.yml, /Dockerfile, /phpinfo
Seen: 2026-11-02 22:22 EST
- 2026-11-02 22:22:02 a host: GET /v2/.env from 35.187.35.191 -> 404, host=a host
- 2026-11-02 22:22:02 a host: GET /config/.env and /config/aws.yml from 35.187.35.191 -> 403 (correctly denied)
- 2026-11-02 22:22:01-03 a host: rapid sweep of secret-file paths (/.env, /credentials.json, /docker-compose.yml, /Dockerfile, /.netrc, /phpinfo, /storage/logs/laravel.log) from 35.187.35.191, mostly 404
show less
IDS fired priority-1 WordPress wp2shell RCE (CVE-2026-63030 & CVE-2026-60137) plus SQLi signatures; ...
show moreIDS fired priority-1 WordPress wp2shell RCE (CVE-2026-63030 & CVE-2026-60137) plus SQLi signatures; the proxy returned 301 redirects, so the attempts were not served.
Target: POST /wp-json/batch/v1 and /?rest_route=/batch/v1 (WordPress REST API), SQL injection in request body
Seen: 2026-11-02 22:41 EST
- 2026-11-02 22:41:01 IDS WordPress Core wp2shell RCE (CVE-2026-63030 & CVE-2026-60137): 209.38.245.233:62221 -> port 80
- 2026-11-02 22:41:01 IDS SQLi rules 1:2053468 (UNION SELECT) and 1:2053465 (SELECT CONCAT) against port 80 from 209.38.245.233:62221
- 2026-11-02 22:41:00-01 a host received POST /wp-json/batch/v1 and POST /?rest_route=/batch/v1 from 209.38.245.233 returning 301
show less
Google Cloud IP probing internet-facing :80 with missing-protocol bytes and a Malicious Fingerprint ...
show moreGoogle Cloud IP probing internet-facing :80 with missing-protocol bytes and a Malicious Fingerprint hit on :443; all requests silently closed.
Target: HTTP :80, missing-protocol requests; Malicious Fingerprint on :443
Seen: 2026-11-02 21:28-21:32 EST
- 2026-11-02 21:28:28 'HTTP Susp. Header' alert for 35.206.138.137 -> :80
- 2026-11-02 21:28:27 'Remote to Local Insecure Flow' for 35.206.138.137:50590 -> :80
- 2026-11-02 21:32:33 IDS 'HTTP request missing protocol' from 35.206.138.137:65074 -> local :80
- 2026-11-02 access log HTTP 444 (silent close) to GET / from 35.206.138.137 (2 requests)
show less
Google Cloud IP repeatedly probing an internet-facing HTTP :80 with malformed missing-protocol and T ...
show moreGoogle Cloud IP repeatedly probing an internet-facing HTTP :80 with malformed missing-protocol and TLS-handshake bytes; all requests silently closed (444).
Target: HTTP :80, malformed missing-protocol and TLS-handshake requests to internet-facing service
Seen: 2026-11-02 21:53-21:58 EST
- 2026-11-02 21:53:13 'HTTP Susp. Header' alert for 35.210.254.127 to internet-facing :80
- 2026-11-02 21:53:06 'Remote to Local Insecure Flow' for 35.210.254.127:19844 -> :80
- 2026-11-02 21:57:09 IDS 'HTTP request missing protocol' from 35.210.254.127:6348 -> local :80
- 2026-11-02 21:55–21:57 access log HTTP 444 (silent close) to GET / from 35.210.254.127 (2 requests)
- 2026-11-02 21:58 TLS handshake probe: overlong/ASCII SSL record bytes sent to :80, returned 400
show less
Enumerated ~70 secret/config/debug files (.env, /.git/config, phpinfo.php, settings.json) against th ...
show moreEnumerated ~70 secret/config/debug files (.env, /.git/config, phpinfo.php, settings.json) against the WordPress vhost; every request denied (403/404) and blocked at the firewall.
Target: HTTPS 443, secret/config file enumeration: /.env variants, /.git/config, /phpinfo.php, /settings.json, /composer.json, /docker-compose.yml
Seen: 2026-11-02 20:30 EST
- GET /.git/config HTTP/2.0 → 403 and 120+ other .env/config/phpinfo paths → 403/404 against host=a host at 2026-11-02 20:30:31-20:30:33
- Firewall blocks on WAN 443 from 34.77.99.151 → port 443 at 20:30:34-20:30:37
show less
Enumerated ~40 phpinfo.php and .env variants against the WordPress vhost; every request denied (403/ ...
show moreEnumerated ~40 phpinfo.php and .env variants against the WordPress vhost; every request denied (403/404).
Target: HTTPS 443, phpinfo.php and secret-file enumeration: /.env variants, /_environment, /info.php
Seen: 2026-11-02 20:19 EST
- GET /_environment → 404 and 40+ phpinfo.php/.env paths → 403/404 against host=a host at 2026-11-02 20:19:03-20:19:08
- Top client in the hour's access log with 168 requests to a single vhost, all non-200
show less
Google Cloud IP ran a rapid secret-file/.env enumeration plus an LFI path-traversal request, all den ...
show moreGoogle Cloud IP ran a rapid secret-file/.env enumeration plus an LFI path-traversal request, all denied.
Target: HTTPS 443 a host, .env/secret-file enumeration incl. LFI /proc/self/environ path traversal
Seen: 2026-11-02 18:40 EST
- At 2026-11-02 18:40:40 EST, GET /userfiles/x?path=../../../../proc/self/environ HTTP/2.0 -> 404 (LFI path traversal toward /proc/self/environ)
- At 2026-11-02 18:40:36-47 EST, ~25+ rapid secret-file probes (.terraform.lock.hcl, /.docker/config.json, /application/.env, /.env.mail, /key.pem, /config/gcp-credentials.json, /graphql, /admin/users, /local_settings.py) -> all 404
- This source triggered IDS alert (multiple common web attacks) and 31151 (web server 4xx errors) from a single IP
show less
Probed for phpinfo.php disclosure then ran a systematic .env enumeration (/.env.prod, /public/.env, ...
show moreProbed for phpinfo.php disclosure then ran a systematic .env enumeration (/.env.prod, /public/.env, /wp/.env, /microservice/.env etc.) across a public vhost; all reads denied 403, phpinfo 404.
Target: HTTPS 443 a host, phpinfo.php discovery + .env path enumeration
Seen: 2026-11-02 17:06 EST
- At 2026-11-02 17:07:27 EST, GET /hosting/phpinfo.php HTTP/1.1 -> 404; 17:07:26 GET /a host/phpinfo.php -> 404; 17:07:22 GET /test/phpinfo.php -> 404 (phpinfo.php discovery across the public vhost)
- At 2026-11-02 17:06:50-57 EST, systematic .env enumeration: /.env.dev /.env.prod /shared/.env /public/.env /wp/.env /wordpress/.env /microservice/.env /gateway/.env -> 403
show less
Malicious-fingerprint inbound connection to the public edge on HTTPS and HTTP; known port scanner (a ...
show moreMalicious-fingerprint inbound connection to the public edge on HTTPS and HTTP; known port scanner (abuse 100, 143 reports).
Target: Public edge ports 443 and 80 (Malicious-Fingerprint inbound)
Seen: 2026-11-02 17:06 EST
- A Malicious-Fingerprint flow from 46.16.34.115:57155 to our edge HTTPS port 443 at 2026-11-02 17:06 EST
- A Malicious-Fingerprint flow from 46.16.34.115:57155 to our edge HTTP port 80 at 2026-11-02 17:06 EST
show less
Nuclei-style secret-hunting scanner sent ~45 rapid requests probing .env, .gitconfig, service-accoun ...
show moreNuclei-style secret-hunting scanner sent ~45 rapid requests probing .env, .gitconfig, service-account JSON and terraform files across two public vhosts, including path-traversal variants; all denied 403/404.
Target: HTTPS 443 vhosts a host / kimberlymackdesignstudio.com, .env and secret-file enumeration incl. /..%2f path traversal
Seen: 2026-11-02 17:39 EST
- At 2026-11-02 17:39:57 EST, GET /api/uploads/%2e%2e%2f%2e%2e%2f.env HTTP/1.1 -> 403 (path traversal aimed at .env) on the public vhost
- At 2026-11-02 17:39:56 EST, GET /laravel../.env HTTP/1.1 -> 403 (path traversal to .env)
- At 2026-11-02 17:39:53-57 EST, ~45 rapid requests to secret-file paths /.env.prod /.env.dev /app/.env /config/gcp-credentials.json /firebase-adminsdk.json /service_account.json /terraform.tfvars /.gitconfig /.env.mail /docker-compose.staging.yml across a host and kimberlymackdesignstudio.com, status 403/404
- Fired web-attack detection ('multiple common web attacks from same source ip') plus 31151 from this source
show less
276 reports), all returned 403.
Target: HTTPS 443, a host vhost (/wp-includes/ directory enumeration ...
show more276 reports), all returned 403.
Target: HTTPS 443, a host vhost (/wp-includes/ directory enumeration)
Seen: 2026-11-02 16:53 EST
- 16:53:24 GET /wp-includes/js/ 403, UA WP-Safe-Scanner/1.0
- 16:53:19 GET /wp-includes/block-supports/ 403
- 16:53:13 GET /wp-includes/IXR/ 403
- 39 requests in the hour, all 403
show less
Enumerated phpinfo and .env secret-file paths on the kimberlymackdesignstudio.com vhost in a ~15s bu ...
show moreEnumerated phpinfo and .env secret-file paths on the kimberlymackdesignstudio.com vhost in a ~15s burst, all requests returned 403/404.
Target: HTTP 80, kimberlymackdesignstudio.com vhost (/phpinfo variants and /.env secret-file paths)
Seen: 2026-11-02 16:34 EST
- 16:34:44 GET /server-info.php 404 on kimberlymackdesignstudio.com vhost
- 16:34:41 GET /phpinfo 404 and 16:34:43 GET /debug.php 404
- 16:34:37 GET /sparkpost/.env 403 and 16:34:29 GET /next/.env 403 (secret-file enumeration)
- 16:34:25 GET /.env.example 403 and 16:34:45 GET /_environment 404
- ~167 requests in the hour, all 403/404, UA Chrome/131
show less
Microsoft (AS8075) IP enumerated ~50 PHP webshell filenames across a host and kimberlymackdesign.com ...
show moreMicrosoft (AS8075) IP enumerated ~50 PHP webshell filenames across a host and kimberlymackdesign.com between 15:15–15:16; all requests returned 404 with empty User-Agent.
Target: HTTP 80 web server, path enumeration of PHP webshells (wp_.php, ch3.php, ans.php, sc.php, wsoo.php, 1q2ase3.php) on vhosts a host and kimberlymackdesign.com
Seen: 2026-11-02 15:15-15:16 EST
- 20.217.184.185 sent GET /ch3.php and GET /sc.php HTTP/1.1, both 404, at 2026-11-02 15:16:20 with empty User-Agent
- 20.217.184.185 sent GET /ans.php HTTP/1.1 -> 404 at 2026-11-02 15:16:22 with empty User-Agent
- 20.217.184.185 enumerated ~50 distinct .php filenames (wp_.php, 1q2ase3.php, wsoo.php, rzadz3.php, class-meta-cache.php) between 15:15 and 15:16, each 404, on vhosts a host and kimberlymackdesign.com
show less
Abuse-100 DigitalOcean IP sent a single flow to the internet-facing HTTPS service that flagged Malic ...
show moreAbuse-100 DigitalOcean IP sent a single flow to the internet-facing HTTPS service that flagged Malicious Fingerprint at 15:26.
Target: HTTPS 443, inbound flow flagged Malicious Fingerprint
Seen: 2026-11-02 15:26 EST
- An inbound flow from 178.128.149.37 to HTTPS port 443 as 'Malicious Fingerprint' at 2026-11-02 15:26:59
- A permitted TCP flow from 178.128.149.37 to internet-facing :443 was seen reaching the service at 2026-11-02 15:26:53
show less
Flooded an internet-facing site with 50+ secret/.env/config file probes in ~3 seconds, all denied (4 ...
show moreFlooded an internet-facing site with 50+ secret/.env/config file probes in ~3 seconds, all denied (403/404).
Target: HTTPS :443, .env/secret/config file enumeration
Seen: 2026-11-02 13:34-13:35 EST
- 2026-11-02 13:34:59 GET /storage/logs/laravel.log -> 404
- 2026-11-02 13:34:58 GET /docker-compose.yml -> 404
- 2026-11-02 13:34:58 GET /.env.prod, /.env-sample, /.gitmodules -> 403
- 2026-11-02 13:34:57 GET /sentry.properties, /settings.json, /config.yaml, /secrets.json -> 404
- 2026-11-02 13:34:56 GET /.env.test, /v1/.env, /app/.env, /core/.env -> 403
- 50+ distinct secret/config/enumerated filenames within ~3 seconds, all denied 403/404
show less
Probed an internet-facing HTTP service with a single TCP SYN flagged as a malicious fingerprint, fro ...
show moreProbed an internet-facing HTTP service with a single TCP SYN flagged as a malicious fingerprint, from a high-abuse Google Cloud IP.
Target: HTTP :80
Seen: 2026-11-02 13:38 EST
- 2026-11-02 13:38:20 TCP SYN from 34.186.132.49:45432 -> port 80, 40-byte packet flagged as a malicious fingerprint
- 2026-11-02 13:38:15 same source port 45432 SYN to :80, no HTTP payload sent
show less
Probed an internet-facing site with /.git/config (denied 444) and a packet flagged as a possible exp ...
show moreProbed an internet-facing site with /.git/config (denied 444) and a packet flagged as a possible exploit, from a DigitalOcean IP.
Target: HTTP :80, /.git/config sensitive-file probe
Seen: 2026-11-02 13:45 EST
- 2026-11-02 13:45:28 GET /.git/config -> 444 on the internet-facing site
- 2026-11-02 13:45:37 Possible-Exploit flow from 161.35.170.105:52184 -> :80 flagged Emergency
- 2026-11-02 13:45:28 TCP SYN from 161.35.170.105:52184 -> port 80
show less
Attack traffic from this IP.
Seen: 2026-11-02 12:15 EST
- 2026-11-02 12:15:03 attacker sent a single ...
show moreAttack traffic from this IP.
Seen: 2026-11-02 12:15 EST
- 2026-11-02 12:15:03 attacker sent a single TCP SYN to destination port 80 (src port 57206)
- 2026-11-02 12:15:09 that flow from this source was classified as Malicious Fingerprint flow engine
show less
Attack traffic from this IP.
Seen: 2026-11-02 12:03 EST
- 2026-11-02 12:03:20 attacker sent a single ...
show moreAttack traffic from this IP.
Seen: 2026-11-02 12:03 EST
- 2026-11-02 12:03:20 attacker sent a single TCP SYN to destination port 80 (src port 46968)
- 2026-11-02 12:03:27 that flow from this source was classified as Malicious Fingerprint flow engine
show less
Keydrop.io scanning bot enumerating secret files (/.env, /.git/config) against the public web; singl ...
show moreKeydrop.io scanning bot enumerating secret files (/.env, /.git/config) against the public web; single flows denied.
Target: Public web HTTP 80 / HTTPS 443, GET /.env and /.git/config secret-file enumeration
Seen: 2026-11-02 04:34-12:32 EST
- 2026-11-02 04:34:58 Web server returned HTTP 444 (silent close) to GET /.env HTTP/1.1 from this source, user-agent Mozilla/5.0; Keydrop.io/1.0
- 2026-11-02 04:34:59 Web server returned HTTP 444 to GET /.git/config HTTP/1.1 from the same Keydrop.io bot
- 2026-11-02 12:32:24 flagged this source as Malicious Fingerprint -> HTTPS :443
show less
Probed the public web (files.thlok.tech) with a Next.js middleware auth-bypass probe (CVE-2025-29927 ...
show moreProbed the public web (files.thlok.tech) with a Next.js middleware auth-bypass probe (CVE-2025-29927); request silently closed.
Target: Public web HTTP 80, GET / on vhost files.thlok.tech (Next.js middleware auth-bypass probe)
Seen: 2026-11-02 12:37 EST
- 2026-11-02 12:37:30 IDS signature 1:2061026:1 "Next.js Middleware Authorization Bypass (CVE-2025-29927)" fired for source 207.175.248.243 -> target :80
- 2026-11-02 12:37:30 Web server silently closed the request (HTTP 444) to GET / with vhost files.thlok.tech from this source
show less
Ran a ~40-request burst of phpinfo and /.env* filename enumeration across our network's public web v ...
show moreRan a ~40-request burst of phpinfo and /.env* filename enumeration across our network's public web vhosts at 10:05, all denied 403/404. Google Cloud data-center IP with recent Hacking/Brute-Force reports.
Target: HTTP 80, secret/config files (/.env, /.env.* and phpinfo variants) on vhosts kimberlymackdesign.com and a host
Seen: 2026-11-02 10:05 EST
- 10:05:00-08: ~40 rapid GET requests for phpinfo variants (phpinfo.php, info.php, p.php, _environment, _profiler/phpinfo...) and secret files across kimberlymackdesign.com and a host vhosts
- 10:05:03 GET /shop/.env HTTP/1.1 -> 403, 10:05:06 GET /brevo/.env -> 403, 10:05:08 GET /phpinfo.php -> 404 (same host, same enumeration, UA Mozilla/5.0 Chrome 131)
- All requests returned 403/404 with nothing leaked, nothing forwarded as exploit
show less
Web App AttackPort Scan
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.