Repeated targeted abuse of our staging admin panel and production MCP endpoint over multiple session ...
show moreRepeated targeted abuse of our staging admin panel and production MCP endpoint over multiple sessions. (1) 2026-05-21 10:11-10:18 UTC: created [email protected] and [email protected] via POST /api/auth/saml-profile in staging, plus 18 curl/8.5.0 probes against production mcp.diligent4.com (/sse, /messages, /mcp, /v1, /chat, /completions, /tools, /api). (2) 2026-05-21 20:00-20:05 UTC: returned and created [email protected] and [email protected], fetched Next.js static chunks (likely to extract endpoint names), then probed /api/user/settings, /api/teams, /api/organizations, /api/usage-events, /health, /dashboard. All requests used user-agent 'curl/8.5.0'. Single-actor singleton IP — no other source matched the pattern.
show less
Mass path scanner hitting our raw load-balancer IP on 2026-05-19 12:11 UTC. POSTed to dozens of Next ...
show moreMass path scanner hitting our raw load-balancer IP on 2026-05-19 12:11 UTC. POSTed to dozens of Next.js / common-CMS targets in rapid succession including /login/api, /_next/server/chunks/ssr, /_next/server/app, /_next/static/chunks, /_rsc, /_react_server, /staging-login, /sigin, /apps, /api, /adfa. All returned 400. Classified malicious by GreyNoise (community API confirms last_seen 2026-05-21) and listed on Spamhaus PBL.
show less
Automated SAML-signup abuse against our staging admin panel on 2026-05-19 11:47-12:10 UTC. Created 6 ...
show moreAutomated SAML-signup abuse against our staging admin panel on 2026-05-19 11:47-12:10 UTC. Created 6 accounts using disposable / impersonation emails (mailinator.com and look-alike flingoos-test domains) via POST /api/auth/saml-profile in a 23-minute burst from a single IP. Also probed /.env, /.env.local, /graphql, /admin, /swagger, /sitemap.xml, /robots.txt, and made unauthorized PUT /api/auth/user attempts (405). Nmap fingerprints in URI strings including '/nice%20ports%2C/Trinity.txt.bak' and 'nmaplowercheck1779194935'. User-agent truncated to literal 'Mozilla/5.0'. Already classified malicious on VirusTotal (MalwareURL, SOCRadar).
show less
HackingBrute-ForceWeb App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.