Hizo 523 solicitudes y generó 121 bloqueos + 220 desafíos. Buscó .env, credenciales de Google Cloud/ ...
show moreHizo 523 solicitudes y generó 121 bloqueos + 220 desafíos. Buscó .env, credenciales de Google Cloud/AWS, /proc/self/environ y /settings.json, fingiendo ser GPTBot, Claude, Amazonbot, GrokBot, etc.
show less
Automated sensitive-file and web application probing against ctman.cl and www.ctman.cl on 2026-09-08 ...
show moreAutomated sensitive-file and web application probing against ctman.cl and www.ctman.cl on 2026-09-08, 12:07:56-12:08:12 UTC, from 34.155.196.140. Cloudflare WAF telemetry contains 258 distinct request Ray IDs across 254 unique paths in this 16-second interval (254 GET, 4 POST).\n\nTargets included /.env, /.env.backup, /.env.production, /.git/config, /aws/.env, /gcp/.env, /sendgrid/.env, /smtp/.env, /phpinfo.php, and /webroot/index.php/_environment. The breadth and speed of enumeration are consistent with automated scanning for exposed configuration, credentials and debug information.\n\nThe 503 returned security-event rows represent 258 distinct requests, not 503 separate requests: 245 Ray IDs each have both skip and precursor_interstitial_page_issued events; 13 have managed_challenge. No successful file retrieval or compromise is established.\n\nExample Cloudflare Ray IDs (UTC): a37dd5f65a83d482 (12:07:57, /.env), a37dd5f5abff0475 (12:07:57 /.env), a37dd5f5abff0475 (12:07:57, /.git/config), a37dd640b883f858
show less
Cloudflare Security Events for ctman.cl recorded 2 GET requests from 45.156.129.113 at 09:09:14 and ...
show moreCloudflare Security Events for ctman.cl recorded 2 GET requests from 45.156.129.113 at 09:09:14 and 09:09:26 GMT-3 on 2026-09-08. Both requests targeted login surfaces that do not belong to this site: /login.do and /showLogin.cc. They occurred within the same coordinated AS211680 burst as adjacent sources probing OWA, Zabbix, Solr, Telerik, JSP, and other application endpoints, using the same Chrome 123 user agent. Both requests were mitigated by a Managed Challenge. Source ASN: AS211680 (NSEC - Sistemas Informaticos, S.A.); reported country: United States. Evidence source: Cloudflare Security Events. Category: Web App Attack (automated application reconnaissance).
show less
Cloudflare Security Events for ctman.cl recorded 3 GET requests from 45.156.129.110 between 09:08:55 ...
show moreCloudflare Security Events for ctman.cl recorded 3 GET requests from 45.156.129.110 between 09:08:55 and 09:09:04 GMT-3 on 2026-09-08. The sequence requested /, /WebInterface/, and /favicon.ico as part of a coordinated AS211680 application-reconnaissance burst. It used the same Chrome 123 user agent and timing pattern as adjacent AS211680 sources probing unrelated administrative and application endpoints. All 3 requests were mitigated by a Managed Challenge. Source ASN: AS211680 (NSEC - Sistemas Informaticos, S.A.); reported country: United States. Evidence source: Cloudflare Security Events. Category: Web App Attack (automated application reconnaissance).
show less
Cloudflare Security Events for ctman.cl recorded 8 GET requests from 45.156.129.112 between 09:08:59 ...
show moreCloudflare Security Events for ctman.cl recorded 8 GET requests from 45.156.129.112 between 09:08:59 and 09:09:42 GMT-3 on 2026-09-08. The address probed unrelated application fingerprints and login surfaces including /index.jsp, /owa/, /js/NewWindow_2_all.js, /zabbix/favicon.ico, and /Telerik.Web.UI.WebResource.axd. The requests formed part of a coordinated AS211680 burst, all used the same Chrome 123 user agent, and all were mitigated by a Managed Challenge. Source ASN: AS211680 (NSEC - Sistemas Informaticos, S.A.); reported country: United States. Evidence source: Cloudflare Security Events. Category: Web App Attack (automated application reconnaissance).
show less
Cloudflare Security Events for ctman.cl recorded 8 GET requests from 45.156.129.111 between 09:09:01 ...
show moreCloudflare Security Events for ctman.cl recorded 8 GET requests from 45.156.129.111 between 09:09:01 and 09:09:42 GMT-3 on 2026-09-08. The requests were part of a coordinated AS211680 burst and probed unrelated application endpoints including /api/session/properties, /identity, /solr/, and /sugar_version.json, plus /. All 8 requests used the same Chrome 123 user agent, identified no legitimate application workflow, and were mitigated by a Managed Challenge. Source ASN: AS211680 (NSEC - Sistemas Informaticos, S.A.); reported country: United States. Evidence source: Cloudflare Security Events. Category: Web App Attack (automated application reconnaissance).
show less
Cloudflare WAF logs for ctman.cl recorded 19 direct GET requests from 216.73.217.174 in the previous ...
show moreCloudflare WAF logs for ctman.cl recorded 19 direct GET requests from 216.73.217.174 in the previous 24 hours on 2026-09-08 (GMT-3), all blocked. The source identified itself as Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected]), from AS16509 in the United States. Eight requests targeted /robots.txt; 11 targeted product pages, including Logitech G513, MSI B550M/B650M, and JBL PRX912 URLs. The site robots policy explicitly says User-agent: ClaudeBot and Disallow: /. Evidence source: Cloudflare Security Events. Category: Bad Web Bot.
show less
Cloudflare Security Analytics for ctman.cl observed 204 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 204 mitigated HTTPS requests from this AS8075 address. The host rapidly probed PHP web-shell and WordPress compromise paths including /ioxi-o.php, /wp-access.php, /wp-act.php, /wp-content/plugins/hellopress/wp_filemanager.php and /this_is_a_new_hello_world.php. Latest sampled event Ray ID: a36ce31d8c1e4b56. This is automated web application exploitation reconnaissance.
show less
Cloudflare Security Analytics for ctman.cl observed 227 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 227 mitigated HTTPS requests from this AS8075 address. The host probed known administrative and web-shell targets including /tinyfilemanager.php, /phpsysinfo.php, /wp-content/plugins/hellopress/wp_filemanager.php, /loxi-o.php and /maxro.php. Latest sampled event Ray ID: a347206bcd9e28db. This is automated web application exploitation reconnaissance.
show less
Cloudflare Security Analytics for ctman.cl observed 241 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 241 mitigated HTTPS requests from this AS8075 address. The host issued a rapid sweep of nonexistent PHP web-shell paths including /mari.php, /file59.php, /reviall.php, /44.php, /os.php, /file61.php and /rxr.php. Latest sampled event Ray ID: a349e5554e48ac54. This is automated web-shell and vulnerability discovery, not legitimate browsing.
show less
Cloudflare Security Analytics for ctman.cl observed 206 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 206 mitigated HTTPS requests from this AS8075 address. The host issued a rapid sweep of nonexistent PHP web-shell paths including /acf1ced8aec2.php, /coffe.php, /kbqhb.php, /asax.php, /zoo2.php, /cjhnp.php and /local.php. Latest sampled event Ray ID: a347cda9da4264a6. This is automated web-shell and vulnerability discovery.
show less
Cloudflare Security Analytics for ctman.cl observed 218 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 218 mitigated HTTPS requests from this AS8075 address. The host rapidly probed administrative and web-shell targets including /tinyfilemanager.php, /server_info.php, /aws_config.php, /loxi-o.php, /filesystems.php and /chosen.php. Latest sampled event Ray ID: a34a2de9388d46b5. This is automated web application exploitation reconnaissance.
show less
Cloudflare Security Analytics for ctman.cl observed 102 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 102 mitigated HTTPS requests from this AS8075 address. The host issued a rapid sweep of nonexistent PHP web-shell paths including /44.php, /file59.php, /rxr.php, /ant.php, /file61.php, /mari.php and /reviall.php. Latest sampled event Ray ID: a3456c307aa6c65d. This is automated web-shell and vulnerability discovery, not legitimate browsing.
show less
Cloudflare Security Analytics for ctman.cl observed 265 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 265 mitigated HTTPS requests from this AS8075 address. The host rapidly probed web-shell and compromised-plugin targets including /w.php, /wp-content/plugins/hellopress/wp_filemanager.php, /BDKR28WP.php, /this_is_a_new_hello_world.php and /acp.php. Latest sampled event Ray ID: a358265d38d9ddfa. This is automated web application exploitation reconnaissance.
show less
Cloudflare Security Analytics for ctman.cl observed 259 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 259 mitigated HTTPS requests from this AS8075 address. The host rapidly probed WordPress internals and PHP web-shell paths including /wp-admin/network/plugins.php, /wp-includes/Text/Diff/Engine/about.php, /wp-content/themes/index.php, /b8.php and /key.php. Latest sampled event Ray ID: a34787349ab7ac42. This is automated web application exploitation reconnaissance.
show less
Cloudflare Security Analytics for ctman.cl observed 291 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 291 mitigated HTTPS requests from this AS8075 address. The host rapidly probed nonexistent WordPress and PHP targets including /wp-config-sample.php, /wp-admin.php, /wp-content/packed.php, /test.php and /hplfuns.php. Latest sampled event Ray ID: a3411645981d67aa. This is automated web-shell and vulnerability discovery, not legitimate browsing.
show less
Cloudflare Security Analytics for ctman.cl observed 106 mitigated HTTPS requests from this AS8075 ad ...
show moreCloudflare Security Analytics for ctman.cl observed 106 mitigated HTTPS requests from this AS8075 address. The host rapidly probed nonexistent PHP and WordPress targets including /file2.php, /file1221.php, /status.php, /php1.php, /vbseo.php and /wp-login.php. Latest sampled event Ray ID: a34040b9b8848617. This is automated web-shell and vulnerability discovery, not legitimate browsing.
show less
Observed 2026-09-07 09:16:33–09:18:18 UTC. Source 20.244.48.10 (AS8075 Microsoft Corporation; geoloc ...
show moreObserved 2026-09-07 09:16:33–09:18:18 UTC. Source 20.244.48.10 (AS8075 Microsoft Corporation; geolocated IN) sent 87 HTTPS GET requests over HTTP/1.1 to www.ctman.cl on TCP/443 in 105 seconds, all targeting /products/hp-a32xflt-abm-eb-840-g11-u5-125u-14in-16gb-512gb-pc. Every request identified itself as sqlmap/1.10.1.55#dev (https://sqlmap.org), an automated SQL-injection testing tool. This is consistent with automated web-application vulnerability reconnaissance, not normal browsing. Cloudflare issued a managed challenge and returned HTTP 403 for all 87 requests. Cloudflare sampleInterval=1 (unsampled). Representative Ray IDs: a3749d85bba24093 (first) and a374a0172b8d0b23 (last).
show less