Automated reconnaissance targeting multiple web servers. The source IP attempted numerous suspicious ...
show moreAutomated reconnaissance targeting multiple web servers. The source IP attempted numerous suspicious HTTP requests, including /admin/login.asp, /remote/login, /cgi-bin/login.cgi and /+CSCOE+/logon.html, among many others. These paths are associated with administrative login interfaces, VPN portals, and network appliance management endpoints. The repeated probing across multiple servers is consistent with automated scanning for exposed administrative interfaces and remote-access services. Although the IP belongs to a netblock identified by AbuseIPDB as Deepfield Genome, the observed request patterns warrant reporting for suspicious scanning activity.
show less
Suspicious automated vulnerability scanning targeting one of our web servers. The source IP attempte ...
show moreSuspicious automated vulnerability scanning targeting one of our web servers. The source IP attempted requests for /containers/json, /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php and /bin/sh. These paths are associated with probing for exposed container management APIs, vulnerable PHPUnit installations and potential command-execution interfaces. Our environment does not use PHP. Activity is consistent with automated reconnaissance and vulnerability scanning for exploitable services.
show less
Automated reconnaissance targeting all our web servers. The source IP repeatedly requested /.git/con ...
show moreAutomated reconnaissance targeting all our web servers. The source IP repeatedly requested /.git/config and /geoserver/web/ across multiple web applications. These paths are commonly probed to identify exposed Git repository configuration files and GeoServer web interfaces, potentially revealing sensitive information or vulnerable services. The systematic requests across multiple servers are consistent with automated vulnerability scanning.
show less
Suspicious HTTP requests targeting our web application, including /.git/config and /geoserver/web/. ...
show moreSuspicious HTTP requests targeting our web application, including /.git/config and /geoserver/web/. These paths are commonly probed to identify exposed Git repository configuration files and GeoServer web interfaces that may reveal sensitive information or expose vulnerable services. The activity is consistent with automated reconnaissance for security misconfigurations and potentially vulnerable software.
show less
Automated vulnerability scanning targeting all our web servers. The source IP attempted numerous sus ...
show moreAutomated vulnerability scanning targeting all our web servers. The source IP attempted numerous suspicious HTTP requests, including /containers/json, /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php and /bin/sh. These requests indicate probing for exposed container management APIs, vulnerable PHPUnit installations and potential command-execution interfaces. Our environment does not use PHP. Activity is consistent with indiscriminate automated reconnaissance and vulnerability scanning across multiple web servers.
show less
Suspicious HTTP requests targeting sensitive configuration files and diagnostic endpoints on one of ...
show moreSuspicious HTTP requests targeting sensitive configuration files and diagnostic endpoints on one of our web applications. The source IP attempted requests for /_profiler/phpinfo, /sendgrid/.env and /.env. These paths are commonly probed to identify exposed PHP diagnostic information and environment configuration files that may disclose API credentials, database connection details and other secrets. Our environment does not use PHP. Activity is consistent with automated vulnerability scanning and attempts to identify exposed sensitive information.
show less
Automated reconnaissance and vulnerability scanning targeting all our web servers. The source IP att ...
show moreAutomated reconnaissance and vulnerability scanning targeting all our web servers. The source IP attempted numerous suspicious HTTP request paths, including /password.php, /geoip/ and /teorema505, among many others. The requests indicate broad, indiscriminate probing for application endpoints, exposed resources and potential vulnerabilities across multiple web servers. Our environment does not use PHP. Activity is consistent with automated web scanning.
show less
Automated reconnaissance targeting all our web servers. The source IP attempted requests to /+CSCOE+ ...
show moreAutomated reconnaissance targeting all our web servers. The source IP attempted requests to /+CSCOE+/logon.html and /remote/login, which are associated with Cisco AnyConnect and Fortinet FortiGate remote-access login interfaces, respectively. This activity is consistent with indiscriminate scanning for exposed VPN services and remote-access infrastructure across multiple web servers.
show less
Suspicious HTTP request targeting /.git/config on our web application, a common reconnaissance techn ...
show moreSuspicious HTTP request targeting /.git/config on our web application, a common reconnaissance technique. The request is consistent with automated probing for security misconfigurations.
show less
Automated reconnaissance targeting all our web applications. The source IP repeatedly probed multipl ...
show moreAutomated reconnaissance targeting all our web applications. The source IP repeatedly probed multiple servers for resources including /phpinfo, /ai/site-profile.json and /sellers.json. These requests indicate indiscriminate scanning for exposed configuration information, metadata and known endpoints. Our environment does not use PHP. The activity is consistent with automated web reconnaissance across multiple targets.
show less
Automated reconnaissance and vulnerability probing against our web application, detected by WAF. Req ...
show moreAutomated reconnaissance and vulnerability probing against our web application, detected by WAF. Requests included /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php, /bin/sh and /containers/json, indicating attempts to identify vulnerable PHP/ PHPUnit installations, potential command-execution interfaces and exposed container management APIs. Our environment does not use PHP. Activity is consistent with automated scanning for exploitable services and exposed infrastructure.
show less
Automated reconnaissance targeting multiple web servers. The source IP attempted the same suspicious ...
show moreAutomated reconnaissance targeting multiple web servers. The source IP attempted the same suspicious HTTP request patterns across all our web servers, including requests for /.well-known/security.txt. This behaviour is consistent with automated web scanning and probing for information across multiple targets.
show less
Repeated automated requests to /RDWeb/Pages/en-US/login.aspx, probing for Microsoft Remote Desktop W ...
show moreRepeated automated requests to /RDWeb/Pages/en-US/login.aspx, probing for Microsoft Remote Desktop Web Access. The requests appear consistent with automated reconnaissance against publicly accessible web services. The source IP has triggered repeated suspicious requests recorded by our Web Application Firewall (WAF).
show less
Automated web application probing/reconnaissance detected from this IP. WAF reported anomalous reque ...
show moreAutomated web application probing/reconnaissance detected from this IP. WAF reported anomalous requests and application logs recorded deliberately malformed/manipulated URL values, including invalid URLs containing unexpected characters and strings. The IP also generated excessive requests to various public application endpoints, exceeding the application's rate limit. The activity is consistent with automated reconnaissance/probing rather than normal user activity.
show less
Detected repeated exploit attempts targeting the GNU Bash "Shellshock" vulnerability (CVE-2014-6271) ...
show moreDetected repeated exploit attempts targeting the GNU Bash "Shellshock" vulnerability (CVE-2014-6271). The firewall's IPS signature "OS-OTHER GNU Bash Environment Variable Handling Command Execution" was triggered.
show less
Automated web vulnerability scanning and reconnaissance activity. Source IP repeatedly requested non ...
show moreAutomated web vulnerability scanning and reconnaissance activity. Source IP repeatedly requested non-existent files and suspicious paths, including random JSP files and malformed nested asset paths, triggering ModSecurity/WAF anomaly detection. Activity appears consistent with automated vulnerability discovery rather than legitimate browsing.
show less
Hello, I hope this email finds you well. I wanted to let you know about our new BANGE backpacks and ...
show moreHello, I hope this email finds you well. I wanted to let you know about our new BANGE backpacks and sling bags that just released. The bags are waterproof and anti-theft, and have a built-in USB cable that can recharge your phone while you're on the go. Both bags are made of durable and high-quality materials, and are perfect for everyday use or travel. Order yours now at 50% OFF with FREE Shipping: http://bangeshop.com Thanks and Best Regards, Nell
show less