Single TCP SYN passes denied at the edge. Abuse-100 internet-census host.
Seen: 2026-11-02 10:37-10: ...
show moreSingle TCP SYN passes denied at the edge. Abuse-100 internet-census host.
Seen: 2026-11-02 10:37-10:38 EST
- 10:37:48 Emergency Malicious-Fingerprint flow 45.156.128.84:17045 -> port 443
- 10:38:15 Critical Remote-to-Local Insecure Flow 45.156.128.84:20192 -> port 443
- 10:37:40 and 10:38:10 firewall: single TCP SYN pass from 45.156.128.84 to port 443 (no block; single-flow only)
show less
Single TCP SYN pass denied at the edge. Chilean data-center host with recent port-scan reports.
Seen ...
show moreSingle TCP SYN pass denied at the edge. Chilean data-center host with recent port-scan reports.
Seen: 2026-11-02 10:42 EST
- 10:42:08 Critical Malicious-Fingerprint flow 64.176.10.199:52693 -> port 443
- 10:42:02 firewall: single TCP SYN pass from 64.176.10.199 to port 443 (no block; single-flow only)
show less
Repeated WordPress comment-spam POSTs to the WP blog vhost returning 500, preceded by a REST post-en ...
show moreRepeated WordPress comment-spam POSTs to the WP blog vhost returning 500, preceded by a REST post-enumeration. Known wp-comments-post.php spammer.
Target: HTTPS 443 a host WordPress wp-comments-post.php comment endpoint
Seen: 2026-11-02 10:48 EST
- 10:48:13, 10:48:20, 10:48:31 POST /wp-comments-post.php HTTP/2.0 -> 500 (WordPress backend error)
- 10:48:13 GET /index.php?rest_route=/wp/v2/posts&per_page=100&_fields=... -> 200 (post enumeration before spam)
show less
Google Cloud datacenter IP enumerating WordPress install paths (wp-includes/wlwmanifest.xml) and xml ...
show moreGoogle Cloud datacenter IP enumerating WordPress install paths (wp-includes/wlwmanifest.xml) and xmlrpc.php against the public web vhost; all requests returned 403/301.
Target: HTTPS 443 vhost, GET //wp-includes/wlwmanifest.xml enumeration and //xmlrpc.php?rsd
Seen: 2026-11-02 09:23 EST
- 09:23:14 GET //xmlrpc.php?rsd HTTP/2.0 -> 403 vhost
- 09:23:15-09:23:18 GET //cms, //site, //test, //shop, //wp1, //wp, //wordpress, //blog, //web wp-includes/wlwmanifest.xml HTTP/2.0 -> 301s, enumerating WordPress install paths
show less
Enumerated ~30 secret-path URLs (/.env, //config/.env, //api/.env, /.production, /.local) over ~7 se ...
show moreEnumerated ~30 secret-path URLs (/.env, //config/.env, //api/.env, /.production, /.local) over ~7 seconds, all returning 403.
Target: HTTPS 443 /web-app secret-file enumeration (/^.*\.env$, /.production, /.local) vhost
Seen: 2026-11-02 07:08 EST
- 07:08:35 GET /.env HTTP/2.0 403 vhost from 34.91.214.200
- 07:08:38 GET //config/.env HTTP/2.0 403 from 34.91.214.200
- 07:08:39 GET //api/.env HTTP/2.0 403 from 34.91.214.200
- 07:08:40 GET //v1/.env and //v2/.env HTTP/2.0 403 from 34.91.214.200
- 07:08:41 GET //laravel/.env and //administrator/.env HTTP/2.0 403 from 34.91.214.200
show less
Repeated TCP flows to the internet-facing web server on :80 matched the network sensor's Malicious-F ...
show moreRepeated TCP flows to the internet-facing web server on :80 matched the network sensor's Malicious-Fingerprint rule.
Target: HTTP 80 internet-facing web server
Seen: 2026-11-02 06:06 EST
- 2026-11-02 06:06:59 TCP flow from 35.206.189.197:45494 to the web server on :80 flagged Malicious-Fingerprint
- 2026-11-02 02:44:26 TCP SYN from 35.206.189.197:45494 to :80 at the edge (3 total hits over 24h)
- 2026-11-02 04:19:37 second Malicious-Fingerprint flow from 35.206.189.197:45478 to the web server on :80
show less
389 reports) matched the Malicious-Fingerprint rule against the internet-facing web server on :443 a ...
show more389 reports) matched the Malicious-Fingerprint rule against the internet-facing web server on :443 and probed ha.thlok.tech.
Target: HTTPS 443 internet-facing web server; GET / on ha.thlok.tech
Seen: 2026-11-02 06:02 EST
- 2026-11-02 06:02:29 TCP flow from 106.63.26.155:5098 to the web server on :443 flagged Malicious-Fingerprint
- 2026-11-02 06:12:17 second Malicious-Fingerprint flow from 106.63.26.155:22637 to the web server on :443
- 2026-11-02 06:12:16 GET / HTTP/1.1 -> 403 on ha.thlok.tech host header from 106.63.26.155
show less
Enumeration of .env secret files and phpinfo info-leak probes against the kimberlymackdesign.com and ...
show moreEnumeration of .env secret files and phpinfo info-leak probes against the kimberlymackdesign.com and a host vhosts; every request denied 403/404.
Target: HTTPS 443 / HTTP 80, vhosts kimberlymackdesign.com and a host; /.env.example, /web/.env, /_environment, /test/phpinfo.php
Seen: 2026-11-02 06:48 EST
- 2026-11-02 06:48:26 GET /.env.example HTTP/1.1 -> 403 on kimberlymackdesign.com host header
- 2026-11-02 06:48:34 GET /web/.env HTTP/1.1 -> 403 on kimberlymackdesign.com host header
- 2026-11-02 06:48:42 GET /_environment HTTP/1.1 -> 404 on kimberlymackdesign.com host header
- 2026-11-02 06:48:40 GET /test/phpinfo.php HTTP/1.1 -> 404 on kimberlymackdesign.com host header
show less
.env/config enumeration and a CVE-2025-29927 Next.js probe against internet-facing ports.
Target: HT ...
show more.env/config enumeration and a CVE-2025-29927 Next.js probe against internet-facing ports.
Target: HTTP 80/443: CVE-2025-29927 header and .env/config enumeration
Seen: 2026-11-02 05:24-05:35 EST
- 05:24:52 TCP/1:2061026 'ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)' from 34.6.120.56:48002 -> port 80
- 05:24:52 TCP SYN pass from 34.6.120.56:48002 to port 80; 05:24:52 TCP SYN pass from 34.6.120.56:50282 to port 443
- 05:35:16 GET /files../.env HTTP/1.1 (attacker request)
- 05:35:16 GET /static//.env HTTP/1.1 (attacker request)
show less
Path-traversal and .env enumeration against the ai.thlok.tech vhost, all denied 400/403.
Target: HTT ...
show morePath-traversal and .env enumeration against the ai.thlok.tech vhost, all denied 400/403.
Target: HTTP 80, vhost ai.thlok.tech: ../../../../proc/self/environ, /files../.env, /.output/server/index.mjs, /api/fs/read path traversal
Seen: 2026-11-02 05:54 EST
- 05:54:22 GET /static/../../../a/../../../../proc/self/environ HTTP/1.1 -> 400 (IDS web attack)
- 05:54:25 GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/1.1 -> 400
- 05:54:20 GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env HTTP/1.1 -> 403
- 05:54:19 GET /files../.env HTTP/1.1 -> 403; GET /.output/server/index.mjs -> 403; all env/config probes denied
show less
Repeated .env/config/secret-file and path-traversal enumeration against internet-facing vhosts, all ...
show moreRepeated .env/config/secret-file and path-traversal enumeration against internet-facing vhosts, all denied 403/404.
Target: HTTP 443, vhosts a host/a host: /.env, /core/.env, /wp-admin/.env, /%2eenv, /userfiles path traversal
Seen: 2026-11-02 05:24 EST
- 05:24:37 GET /.a host HTTP/2.0 -> 403 upstream
- 05:24:38 GET /userfiles?path=../../../../.env HTTP/2.0 -> 403 (IDS web attack)
- 05:24:37 GET /%2eenv HTTP/2.0 -> 403
- 05:24:41 GET /core/.env HTTP/2.0 -> 403
- 05:24:39 GET /settings/developer HTTP/2.0 -> 404; sweep of env/config/secret paths, every request denied
show less
Single TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerpri ...
show moreSingle TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerprint.
Target: Port 80 (internet-facing web service)
Seen: 2026-11-02 05:59 EST
- 05:59:57 TCP SYN pass from 35.206.187.243:45531 to port 80 at the edge firewall
- 06:00:02 Emergency Malicious Fingerprint flow 35.206.187.243:45531 -> port 80
show less
Single TCP SYN probe to the internet-facing web service on port 443, flagged as a Malicious Fingerpr ...
show moreSingle TCP SYN probe to the internet-facing web service on port 443, flagged as a Malicious Fingerprint.
Target: Port 443 (internet-facing web service)
Seen: 2026-11-02 05:41 EST
- 05:41:18 TCP SYN pass from 35.210.246.75:45548 to port 443 at the edge firewall
- 05:41:26 Critical Malicious Fingerprint flow 35.210.246.75:45548 -> port 443
show less
Single TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerpri ...
show moreSingle TCP SYN probe to the internet-facing web service on port 80, flagged as a Malicious Fingerprint.
Target: Port 80 (internet-facing web service)
Seen: 2026-11-02 05:04 EST
- 05:04:05 TCP SYN pass from 95.214.54.159:45240 to port 80 at the edge firewall
- 05:04:11 Critical Malicious Fingerprint flow 95.214.54.159:45240 -> port 80
show less
Attack traffic from this IP.
Target: Internet-facing port 80 and 443 — scanning/web-probe, IDS CVE-2 ...
show moreAttack traffic from this IP.
Target: Internet-facing port 80 and 443 — scanning/web-probe, IDS CVE-2025-29927 hit and port-80 blocks
Seen: 2026-11-02 02:47-04:37 EST
- 04:27:51 EST — IDS 1:2061026 'ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)' matched 34.146.220.227:38440 -> port 80
- 02:47:54 EST — IDS alert to WAN port 8080 blocked from this IP; firewall block on port 80 at 04:37:15
show less
Google Cloud IP ran an automated secret-file/config enumeration against a lab vhost, spoofing dozens ...
show moreGoogle Cloud IP ran an automated secret-file/config enumeration against a lab vhost, spoofing dozens of legitimate-crawler user-agents (Googlebot, ClaudeBot, GPTBot, PerplexityBot, Bytespider, etc.) and probing .env, config.py, local_settings.py and GraphQL paths; every request hit the site's bas...
Target: HTTP host=tuner.thlok.tech: secret-file/config enumeration (/.env, /config.py, /local_settings.py, /wp-config.*, path-traversal) plus /graphql, all returned 401 basic-auth
Seen: 2026-11-02 04:21 EST
- 04:21:25 EST — GET /cmd/.env, /internal/.env, /dashboard/.env, /common/.env, /shared/.env on host=tuner.thlok.tech, all 401, spoofed crawler user-agents
- 04:21:24 EST — GET /config.py, /local_settings.py, /app/settings.py, /core/settings.py, /app/local_settings.py on host=tuner.thlok.tech, all 401
- 04:21:24 EST — POST /v1/graphql and POST /graphql on host=tuner.thlok.tech returned 401; GET /openapi.json and /docs also 401
- 04:21:23 EST — GET /userfiles?path=../../../../.env, /cache/original/%2e%2e/.env...
show less
IP-based secret/config enumeration across the WordPress blog and static vhosts: .env, .git-credentia ...
show moreIP-based secret/config enumeration across the WordPress blog and static vhosts: .env, .git-credentials, firebase-adminsdk.json, phpinfo.php, terraform.tfstate and dozens more, rotating many distinct AI-bot user-agents.
Target: HTTP 80/443 on vhosts a host and kimberlymackdesign.com: /env, /.git-credentials, /firebase-adminsdk.json, /phpinfo.php, /terraform.tfstate, /proc/self/environ path traversal
Seen: 2026-11-02 03:28 EST
- 03:28:23 GET /debug -> 404 from 34.22.134.141
- 03:28:22 GET /api/console/api_server?sense_version=...&apis=../../../../../../proc/self/environ -> 404 (
- 03:28:23 GET /.git-credentials -> 403
- 03:28:22 GET /firebase-adminsdk.json -> 404
- 03:28:24 GET /terraform.tfstate.backup -> 404 on kimberlymackdesign.com
- 03:28:24 GET /scripts/.env -> 403 on kimberlymackdesign.com
show less
Probed a host for /z9x8c7v6b5-debug-trigger and /internal and /dashboard (both 403), then ran an .en ...
show moreProbed a host for /z9x8c7v6b5-debug-trigger and /internal and /dashboard (both 403), then ran an .env path-traversal sweep on the WordPress blog.
Target: HTTPS 443 a host: /z9x8c7v6b5-debug-trigger-ai /internal /dashboard; HTTP 80 kimberlymackdesign.com path traversal
Seen: 2026-11-02 03:37 EST
- 03:37:12 GET /a host -> 403
- 03:37:12 GET /internal HTTP/1.1 -> 403
- 03:37:11 GET /dashboard -> 403
- 03:28:24 GET /backend/settings.py -> 404 on kimberlymackdesign.com
- 03:28:24 GET /serverless.yaml -> 404 on kimberlymackdesign.com
show less
Sending HEAD /.env to multiple public vhosts; all blocked with 403/404.
Target: HTTPS 443
Seen: 2026 ...
show moreSending HEAD /.env to multiple public vhosts; all blocked with 403/404.
Target: HTTPS 443
Seen: 2026-11-01 06:18-07:40 EST
- 07:40:45 a host: attacker sent HEAD /.env to port 443, returned HTTP 403 - exposed-config-file probe denied
- 06:18:34 a host: attacker sent HEAD /.env to port 443, returned HTTP 404 - same secret-file enumeration against a second vhost
show less
Enumerated dozens of .env/secret/config and credential paths on the site over HTTPS 443 and HTTP 80 ...
show moreEnumerated dozens of .env/secret/config and credential paths on the site over HTTPS 443 and HTTP 80 using dozens of spoofed AI-crawler user-agents, including ../ path-traversal payloads; all denied.
Target: HTTPS 443 / HTTP 80 on the public site; paths incl /.env, /.env.sendgrid, /.aws/credentials, /var/run/secrets/.../serviceaccount/token, /.bashrc, /gcp-key.json, and ../../../../proc/self/environ pa...
Seen: 2026-11-01 06:10 EST
- 06:10:17 GET /.aws/credentials HTTP/1.1 403 - credential-file enumeration, denied
- 06:10:17 GET /var/run/secrets/kubernetes.io/serviceaccount/token HTTP/1.1 404 - k8s token probe, denied
- 06:10:18 GET /.env HTTP/1.1 403 - .env secret probe, denied
- 06:10:19 GET /.env.sendgrid HTTP/1.1 403 - sendgrid env probe, denied
- 06:10:17 GET /static/..;/..;/.env HTTP/1.1 403 - encoded path traversal to .env, denied
- 06:10:19 GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1 404 - path traversal, denied (IDS 31153)
show less
Contabo IP flagged as a Malicious-Fingerprint single TCP SYN against HTTP/80.
Target: TCP/80 HTTP si ...
show moreContabo IP flagged as a Malicious-Fingerprint single TCP SYN against HTTP/80.
Target: TCP/80 HTTP single SYN flow to the edge web service
Seen: 2026-11-01 03:34 EST
- 03:34:22 [Critical] Flow [Malicious Fingerprint] 195.26.248.142:57831 -> port 80
- 03:34:16 firewall single TCP SYN (flags 0,S) 195.26.248.142:57831 -> :80 passed to edge
show less
All denied 403/404.
Target: Env/config/secret files on vhosts kimberlymackdesign.com and kimberlymac ...
show moreAll denied 403/404.
Target: Env/config/secret files on vhosts kimberlymackdesign.com and kimberlymackdesignstudio.com
Seen: 2026-11-01 02:03-02:05 EST
- 02:05:13 a host: 194.180.49.41 GET /.env.save returned 403; same host then probed /.env, /.env.bak, /.env.backup, /.a host, /.env.old, /.env.production, /parameters.yml, /config.php — all 403/404
- 02:03:45-02:03:51 a host: 194.180.49.41 repeated the same /.env* / .aws/credentials / parameters.yml / config.php sweep on host kimberlymackdesign.com, every request denied 403/404
- IDS alert at 02:05:14: 'Sustained web attack from known-hostile source 194.180.49.41'
show less
Web App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.