Part of a scanning sweep from 216.180.246.0/24 against our nginx edge (Singapore), 2026-10-13 ~11:50 ...
show morePart of a scanning sweep from 216.180.246.0/24 against our nginx edge (Singapore), 2026-10-13 ~11:50 UTC: GET / by IP (HTTP 400); sibling IPs probed admin/VPN login paths.
show less
Vulnerability scanner: probed 554 unique paths against nginx vserver adsproxycsp1-1.ssl207, ~1163 re ...
show moreVulnerability scanner: probed 554 unique paths against nginx vserver adsproxycsp1-1.ssl207, ~1163 requests, all returned 403. Same scan signature as 139.87.112.69 (same /24, same probe set): /system/login, /status/ path-traversal variants (%c0%ae, %e0%80%ae, %f0%80%80%ae overlong UTF-8 encodings), /metrics, /system/database/drivers/mssql/index.html, /rest/api/latest/repos (Bitbucket API probe).
show less
Automated web-application vulnerability scan against our reverse-proxy edge node adsproxycsp1-1.sor2 ...
show moreAutomated web-application vulnerability scan against our reverse-proxy edge node adsproxycsp1-1.sor245 (Oregon DC) on 2026-09-05: 142 requests covering 71 unique probe paths targeting known CMS/admin-panel fingerprints (e.g. /sap/public/bc/ur/Login/assets/corbu/sap_logo.png, /templates/advancedThemeWbFlat/images/user.png, /media/users/admin/faceyourmanga_admin_girl.png, /include/SugarCharts/swf/pieChart.swf, /theme/eldy/img/object_company.png). Same probe set as concurrent scans from 139.87.112.72 and 139.87.112.140 against sibling hosts, all part of one coordinated sweep from the 139.87.112.0/24 range. All requests returned HTTP 404. Identified via nginx access/error log analysis.
show less
Automated web-application vulnerability scan against 8 of our reverse-proxy edge nodes (adsproxycsp1 ...
show moreAutomated web-application vulnerability scan against 8 of our reverse-proxy edge nodes (adsproxycsp1 role, Oregon DC) within the same short window on 2026-09-05: sor183, sor185, sor192, sor193, sor198, sor199, sor200, sor212. Roughly 71-142 requests per host (1065 total), each covering the identical set of 71 unique probe paths targeting known CMS/admin-panel fingerprints, e.g. /sap/public/bc/ur/Login/assets/corbu/sap_logo.png, /templates/advancedThemeWbFlat/images/user.png, /templates/advancedThemeWbFlat/images/tabr.jpg, /media/users/admin/faceyourmanga_admin_girl.png, /include/SugarCharts/swf/pieChart.swf, /include/images/iphone-listArrow.png, /theme/eldy/img/object_company.png, /theme/eldy/img/object_energie.png. All requests returned HTTP 404 (paths do not exist on our hosts). Identified via nginx access/error log analysis.
show less
Automated web-application vulnerability scan against our reverse-proxy edge node adsproxycsp1-1.sor2 ...
show moreAutomated web-application vulnerability scan against our reverse-proxy edge node adsproxycsp1-1.sor225 (Oregon DC) on 2026-09-05: 142 requests covering 71 unique probe paths targeting known CMS/admin-panel fingerprints (e.g. /sap/public/bc/ur/Login/assets/corbu/sap_logo.png, /templates/advancedThemeWbFlat/images/user.png, /media/users/admin/faceyourmanga_admin_girl.png, /include/SugarCharts/swf/pieChart.swf, /theme/eldy/img/object_company.png). Same probe set as concurrent scans from 139.87.112.72 and 139.87.112.48 against sibling hosts, all part of one coordinated sweep from the 139.87.112.0/24 range. All requests returned HTTP 404. Identified via nginx access/error log analysis.
show less
Aggressive web app scan: 106 requests to 79 unique paths against a single adsproxy edge server, incl ...
show moreAggressive web app scan: 106 requests to 79 unique paths against a single adsproxy edge server, including Solr admin endpoints (/solr/admin/info/system, /solr/admin/cores) and an InfluxDB probe (/query?q=SHOW+DIAGNOSTICS), plus /index.php and generic paths. All returned 400.
show less
Fleet-wide scan: 15-16 requests to 15 unique paths (400 responses) simultaneously against 5 differen ...
show moreFleet-wide scan: 15-16 requests to 15 unique paths (400 responses) simultaneously against 5 different adsproxy edge servers (adsproxycsp1-1.ssg10077/78/79/80/91), same probe set on each host.
show less
Part of the same coordinated mass vulnerability scan as 139.87.112.4/23/78/145 (reported minutes ear ...
show morePart of the same coordinated mass vulnerability scan as 139.87.112.4/23/78/145 (reported minutes earlier for the same fleet). Hitting adsproxycsp1 edge nodes with 403 probes for /cache/.env, /cache/.git/config, /system/login. Source: Oracle Public Cloud, same /24 subnet.
show less
Part of the same coordinated mass vulnerability scan as 139.87.112.4/23/78/145 (reported minutes ear ...
show morePart of the same coordinated mass vulnerability scan as 139.87.112.4/23/78/145 (reported minutes earlier for the same fleet). Hitting adsproxycsp1 edge nodes with 403 probes for /rest/api/latest/repos (Bitbucket), /system/database/drivers/mssql/index.html, /system/login. Source: Oracle Public Cloud, same /24 subnet.
show less
Part of the same coordinated mass vulnerability scan as 139.87.112.4/23/78/145 (reported minutes ear ...
show morePart of the same coordinated mass vulnerability scan as 139.87.112.4/23/78/145 (reported minutes earlier for the same fleet). Hitting adsproxycsp1 edge nodes with 403 probes for /rest/api/latest/repos (Bitbucket), /system/database/drivers/mssql/index.html, /system/login. Source: Oracle Public Cloud, same /24 subnet.
show less
Mass vulnerability scan against ad-serving ingress fleet: 16740 requests in 1 hour, all 404. Same CV ...
show moreMass vulnerability scan against ad-serving ingress fleet: 16740 requests in 1 hour, all 404. Same CVE-probe signature as coordinated source IPs 139.87.112.23/.78/.145 (Cisco WebACS, Atlassian Confluence/Crowd, Apache OFBiz, D-Link, Joomla paths), plus IDOR-style enumeration of /2014/users/N/shipping_addresses. Source: Oracle Public Cloud.
show less
Mass vulnerability scan against ad-serving ingress fleet: 15847 requests in 1 hour, all 404. Same CV ...
show moreMass vulnerability scan against ad-serving ingress fleet: 15847 requests in 1 hour, all 404. Same CVE-probe signature as coordinated source IPs 139.87.112.23/.78/.4 (Cisco WebACS, Atlassian Confluence/Crowd, Apache OFBiz, D-Link, Joomla paths), plus IDOR-style enumeration of /2014-2015/users/N/shipping_addresses. Source: Oracle Public Cloud.
show less
Mass vulnerability scan against ad-serving ingress fleet: 18134 requests in 1 hour, all 404. Same CV ...
show moreMass vulnerability scan against ad-serving ingress fleet: 18134 requests in 1 hour, all 404. Same CVE-probe signature as coordinated source IPs 139.87.112.23/.4/.145 (Cisco WebACS, Atlassian Confluence/Crowd, Apache OFBiz, D-Link, Joomla paths). Source: Oracle Public Cloud.
show less
Mass vulnerability scan against ad-serving ingress fleet: 56180 requests in 1 hour, all 404. Probing ...
show moreMass vulnerability scan against ad-serving ingress fleet: 56180 requests in 1 hour, all 404. Probing known CVE paths for multiple unrelated products (Cisco WebACS /webacs/js/xmp/nls/xmp.js, Atlassian Confluence /userlogin.action, Atlassian Crowd /crowd/about.jsp, Apache OFBiz /accounting/control/main, D-Link /xmldata, Joomla /language/en-GB/langmetadata.xml) plus generic /login and /index.php sweeps. Source: Oracle Public Cloud.
show less
Web vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:09:53:4 ...
show moreWeb vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:09:53:49 +0000 and 30/Aug/2026:12:42:24 +0000 for non-existent sensitive paths (/.git/config), all returned 404. Detected via nginx ingress access log.
show less
Web vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:21:50:5 ...
show moreWeb vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:21:50:55 +0000 and 30/Aug/2026:21:50:58 +0000 for non-existent sensitive paths (/.env), all returned 404. Detected via nginx ingress access log.
show less
Web vulnerability scanning against ad-serving endpoint: 4 probe requests between 30/Aug/2026:10:25:4 ...
show moreWeb vulnerability scanning against ad-serving endpoint: 4 probe requests between 30/Aug/2026:10:25:48 +0000 and 30/Aug/2026:10:25:46 +0000 for non-existent sensitive paths (/vendor/phpunit/Util/PHP/eval-stdin.php, /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php, /vendor/phpunit/src/Util/PHP/eval-stdin.php, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php), all returned 404. Detected via nginx ingress access log.
show less
Web vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:06:55:3 ...
show moreWeb vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:06:55:31 +0000 and 30/Aug/2026:06:55:10 +0000 for non-existent sensitive paths (/ext.ssg10079.incmdb.net/.env, /old/.env, /wp-content/.env), all returned 404. Detected via nginx ingress access log.
show less
Web vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:06:55:1 ...
show moreWeb vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:06:55:17 +0000 and 30/Aug/2026:06:55:29 +0000 for non-existent sensitive paths (/admin/.env, /public/.env, /database/.env), all returned 404. Detected via nginx ingress access log.
show less
Web vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:06:55:0 ...
show moreWeb vulnerability scanning against ad-serving endpoint: 3 probe requests between 30/Aug/2026:06:55:09 +0000 and 30/Aug/2026:06:55:27 +0000 for non-existent sensitive paths (/conf/.env, /backend/.env, /www/.env), all returned 404. Detected via nginx ingress access log.
show less
Web vulnerability scanning against ad-serving endpoint: 4 probe requests between 31/Aug/2026:07:55:3 ...
show moreWeb vulnerability scanning against ad-serving endpoint: 4 probe requests between 31/Aug/2026:07:55:37 +0000 and 31/Aug/2026:07:55:37 +0000 for non-existent sensitive paths (/.well-known/security.txt), all returned 404. Detected via nginx ingress access log.
show less
Bad Web BotWeb App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.