Automated vulnerability scanning against our ad-serving web servers: 271 HTTP 4xx probes across 7 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 271 HTTP 4xx probes across 7 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /222.php, /55.php, /82.php, /FWAZ.php, /X.php, /a1.php. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 296 HTTP 4xx probes across 7 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 296 HTTP 4xx probes across 7 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /+CSCOT+/oem-customization, /Account/Login, /Guest.aspx, /_layouts/15/error.aspx, /admin/config.php, /api/v1/system/platform. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 360 HTTP 4xx probes across 5 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 360 HTTP 4xx probes across 5 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /000.php, /122.php, /206.php, /82.php, /ah25.php, /bk.php. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 402 HTTP 4xx probes across 1 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 402 HTTP 4xx probes across 1 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.env.production.local, /api/3HCrcgwtcKTYCuPG9KrwI9CEvgJ, /api/v1/system/system-information, /api/v1/users, /backup2.cgi, /wp-content/wphb-logs/api-debug.log. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 329 HTTP 4xx probes across 8 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 329 HTTP 4xx probes across 8 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /1.php, /100.php, /24.php, /485.php, /584062352875874akp.php, /60856e3a4findex.php. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 404 HTTP 4xx probes across 9 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 404 HTTP 4xx probes across 9 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.circleci/config.yml, /.config, /.env, /.env.bak, /.env.save, /_ignition/health-check. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 504 HTTP 4xx probes across 5 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 504 HTTP 4xx probes across 5 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.aws/credentials, /.env.backup, /.env.local, /.env.old, /.env.production, /.github/workflows. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 496 HTTP 4xx probes across 4 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 496 HTTP 4xx probes across 4 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /199.php, /2P.php, /aaf.php, /abcd.php, /b00869ae6e.php, /bajah.php. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 505 HTTP 4xx probes across 6 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 505 HTTP 4xx probes across 6 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /+CSCOE+/logon.html, /Account/Login, /App_Themes/Default/Images/favicon.ico, /Nmap/folder/check1785240017, /Nmap/folder/check1785701355, /api/v1/check-version. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 530 HTTP 4xx probes across 4 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 530 HTTP 4xx probes across 4 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /api/config/tsconfig.json, /api/phpinfo, /api/phpinfo.php, /api_keys.js, /app/.env.bak, /app/.env.dist. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 559 HTTP 4xx probes across 5 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 559 HTTP 4xx probes across 5 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /App_Themes/Default/Images/favicon.ico, /CFIDE/componentutils, /NmapUpperCheck1785556662, /admin/reports/updates, /allversions, /api/v2/about. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 606 HTTP 4xx probes across 1 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 606 HTTP 4xx probes across 1 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /accounts/login, /admin, /index.php, /libs/libs/bower/bower_components/yui2/sandbox/treeview/readd.php, /pentaho/Login, /wp-content/plugins/crm-perks-forms/templates/sample_file.php. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 589 HTTP 4xx probes across 5 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 589 HTTP 4xx probes across 5 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.aws/credentials, /.axiom/accounts/do.json, /WEB-INF/xwiki.cfg, /actuator/configprops, /actuator/env, /actuator/heapdump. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 703 HTTP 4xx probes across 1 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 703 HTTP 4xx probes across 1 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.aws/credentials/phpinfo, /awstats/.env, /lara/phpinfo.php, /server_info.php, /wp-config.php.save, /x.php. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 612 HTTP 4xx probes across 3 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 612 HTTP 4xx probes across 3 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.well-known/stripe, /.wp-config.php.swp, /API.md, /API/config.js, /API/config/common.js, /API/config/database.js. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 1540 HTTP 4xx probes across 1 p ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 1540 HTTP 4xx probes across 1 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /bitrix/redirect.php, /index.action, /public/index.php, /wp-content/plugins/all-in-one-event-calendar/readme.txt, /wp-content/plugins/skysa-official/readme.txt, /wp-content/plugins/sniplets/readme.txt. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 710 HTTP 4xx probes across 9 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 710 HTTP 4xx probes across 9 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.aws/credentials, /.env, /.env.backup, /.env.bak, /.env.development, /.env.local. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 751 HTTP 4xx probes across 8 pu ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 751 HTTP 4xx probes across 8 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.docker/.env, /.env, /.env.backup, /.env.copy, /.env.development, /.env.example. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 2174 HTTP 4xx probes across 9 p ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 2174 HTTP 4xx probes across 9 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.env, /.env.example, /.env.example.php, /.env.json, /.env.local.php, /.env.php-backup. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability scanning against our ad-serving web servers: 2173 HTTP 4xx probes across 9 p ...
show moreAutomated vulnerability scanning against our ad-serving web servers: 2173 HTTP 4xx probes across 9 public web front-ends between 2026-07-27 and 2026-08-03 (UTC). Sample probed paths: /.EnV.SeNdGrId, /.eNv, /.env, /.env.BAK, /.env.bak, /.env.docker.jpg. Non-existent paths, no legitimate traffic from this IP.
show less
Automated vulnerability probing against our public ad-serving platform. 2026-08-01: 111 requests res ...
show moreAutomated vulnerability probing against our public ad-serving platform. 2026-08-01: 111 requests resulting in HTTP 404 across two backend nodes, User-Agent 'Go-http-client/2.0'. Requests target non-existent admin and CMS endpoints, not our published API. No business relationship with this source; scanning was not authorised by us. Evidence from application access logs.
show less
Unsolicited web application vulnerability scan against our public ad-serving platform. 2026-08-01 09 ...
show moreUnsolicited web application vulnerability scan against our public ad-serving platform. 2026-08-01 09:14:23-09:59:39 UTC: at least 3323 requests that resulted in HTTP 404 across three backend nodes, 1196 distinct URLs probed. User-Agent forged as 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0'. Probed paths target known CVEs and admin panels: /crowd/about.jsp (Atlassian Crowd), /userlogin.action (Apache Struts), /accounting/control/main (Apache OFBiz), /webacs/js/xmp/nls/xmp.js (Cisco Prime Infrastructure), /xmldata (HP System Management Homepage), /language/en-GB/langmetadata.xml (Joomla), /dp/login.xml, /index.php, /login, plus REST API enumeration of /2014|2015/users/N/shipping_addresses. Same /24 scanned our perimeter earlier the same day from 139.87.112.102 and 139.87.112.147, and on 2026-07-07 from 139.87.112.70. No business relationship with this source; scanning was not authorised by us. Evidence from application access logs.
show less
Unsolicited web application vulnerability scan against our public HTTPS/HTTP endpoint. 2026-08-01 08 ...
show moreUnsolicited web application vulnerability scan against our public HTTPS/HTTP endpoint. 2026-08-01 08:23:19-08:56:43 UTC: 27256 requests, 554 distinct URLs, ~14 rps sustained, both port 80 and 443 (TLSv1.3), Host header set to the bare server IP. 1202 requests blocked with 403 and 2584 with 405. Probed paths include /system/login, /status/phpinfo.php, /system/console/bundles, /rest/api/, /metrics, and overlong-UTF8 path traversal such as /status/%c0%ae%c0%ae/%c0%ae%c0%ae/. Requests carry scanner canary paths (/qualystest.xyz, /QUALYS730242, /QUALYS13785). No business relationship with this source; scanning was not authorised by us. Same /24 previously scanned our infrastructure on 2026-07-07 from 139.87.112.70. Evidence from nginx access logs.
show less
Unsolicited web application vulnerability scan against our public HTTPS/HTTP endpoint. 2026-08-01 08 ...
show moreUnsolicited web application vulnerability scan against our public HTTPS/HTTP endpoint. 2026-08-01 08:17:02-08:30:04 UTC: 6952 requests, 543 distinct URLs, both port 80 and 443 (TLSv1.3), Host header set to the bare server IP. 1096 requests blocked with 403 and 178 with 405. Probed paths include /system/login, /status/phpinfo.php, /dynamiccontent.properties.jsf (Oracle WebLogic RCE probe), /level/42/exec/- (Cisco IOS), /userfiles/elements/text, plus overlong-UTF8 path traversal such as /status/%c0%ae%c0%ae/%c0%ae%c0%ae/. Non-standard HTTP methods used (BADMTHD, TRACE, OPTIONS). Requests carry scanner canary paths (/qualystest.xyz, /QUALYS730242). No business relationship with this source; scanning was not authorised by us. Same /24 previously scanned our infrastructure on 2026-07-07 from 139.87.112.70. Evidence from nginx access logs.
show less
Automated vulnerability scanner hitting our nginx reverse proxy. 2543 requests across 1020 unique UR ...
show moreAutomated vulnerability scanner hitting our nginx reverse proxy. 2543 requests across 1020 unique URLs, all rejected with HTTP 403/405. Probed paths include /xmlrpc.php (WordPress), /geoserver/wms (GeoServer RCE), /system/login, /nf/auth/doAuthentication.do, /p/u/doAuthentication.do (admin/auth probes), guestbook_entries. Requests sent both to bare server IP and hostname. Not a legitimate client.
show less
Bad Web BotWeb App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.