Sustained large-scale content scraping/crawling (~63,000 requests over ~4h) against production websi ...
show moreSustained large-scale content scraping/crawling (~63,000 requests over ~4h) against production website, systematically crawling legitimate content pages. ~95% already throttled by rate limiting. No injection payloads observed.
show less
Automated wordlist-based content/endpoint discovery against a CMS (probing /Page, /Template, /File/U ...
show moreAutomated wordlist-based content/endpoint discovery against a CMS (probing /Page, /Template, /File/Upload, /Export, /odata, /web.config, /Content/Upload, etc.), active in the same window and against the same target as a Nuclei scan from a related IP on the same hosting provider.
show less
Reconnaissance probe (phpinfo) against production web infrastructure, including a real production ho ...
show moreReconnaissance probe (phpinfo) against production web infrastructure, including a real production hostname. Same /29 range as 45.148.10.59, already reported for admin-login reconnaissance via a Bot Manager bypass on this same target.
show less
Hidden GET parameter discovery/fuzzing tool (Arjun-style signature: random alphanumeric param names ...
show moreHidden GET parameter discovery/fuzzing tool (Arjun-style signature: random alphanumeric param names with incrementing numeric values) run systematically against multiple pages in a ~70 minute automated burst (~3800 requests). Unauthorized reconnaissance against production and non-prod hosts.
show less
Escalating brute-force/scan against CMS login (Security/Login, GET+POST) combined with cache-poisoni ...
show moreEscalating brute-force/scan against CMS login (Security/Login, GET+POST) combined with cache-poisoning header-fuzzing (X-Forwarded-For-IP, X-XSRF-TOKEN, Front-End-Https query params). Volume tripled every 30min (5.8k to 109k req/30min) before being blocked.
show less
Automated mass vulnerability scan: 164k+ distinct URI probes across 11 hostnames in 5h (path travers ...
show moreAutomated mass vulnerability scan: 164k+ distinct URI probes across 11 hostnames in 5h (path traversal /etc/passwd, XSS via svg onload, SSRF probes via interact.sh, admin/credential enumeration, known CVE-pattern paths jeecg-boot/jolokia/awstats). 100% blocked by existing WAF rules, zero successful requests.
show less
Active vulnerability scanner: combined XSS + SQL injection (blind SLEEP-based) + path traversal payl ...
show moreActive vulnerability scanner: combined XSS + SQL injection (blind SLEEP-based) + path traversal payloads bundled in single query string parameters, targeting the root path of 3 subdomains simultaneously. Also probed Bitrix CMS SSRF endpoint (redirect.php) using interactsh.com/interact.sh out-of-band interaction service, and repeated reconnaissance on CMS admin login page. Verified: SQLi did not execute (response time normal, not the expected 5s delay), no successful exploitation.
show less
WordPress vulnerability scanner bypassing our trusted-bot allowlist (spoofed Googlebot User-Agent) t ...
show moreWordPress vulnerability scanner bypassing our trusted-bot allowlist (spoofed Googlebot User-Agent) to reach our CMS admin login page directly (24x GET on /Security/Login within a 19-min window), plus REST API batch endpoint enumeration (?rest_route=/batch/v1) and wp-login.php/wp-json probing across multiple path variants. No credential submission observed, reconnaissance only.
show less
Large-scale automated vulnerability scan against our web infrastructure (~72,000 requests in 30 min, ...
show moreLarge-scale automated vulnerability scan against our web infrastructure (~72,000 requests in 30 min, sustained): PHP command injection (${system(ls)}), path traversal to /etc/passwd via multiple encodings, ColdFusion/Lucee admin panel probing (/lucee/admin/web.cfm), JSF/ColdFusion resource traversal. Targeted 3 environments simultaneously. Rotating legacy browser User-Agents. Verified: no successful exploitation, all responses were benign homepage/login fallbacks.
show less
Vulnerability scanner: reflected XSS payloads, path traversal, auth-bypass probing, and use of an ou ...
show moreVulnerability scanner: reflected XSS payloads, path traversal, auth-bypass probing, and use of an out-of-band interaction service (oast.me) to detect blind SSRF. Same tooling signature as 103.187.94.236 (same /24), already reported.
show less
Automated vulnerability scan (DAST-style) against our web infrastructure: 186,373 requests blocked i ...
show moreAutomated vulnerability scan (DAST-style) against our web infrastructure: 186,373 requests blocked in ~4h (peak 125,782 req in a single hour), fuzzing real content paths with SQLi-style payloads embedded in headers. Confirmed malicious via our own WAF/access logs.
show less
scan of secrets (`.svn/entries`, `.ssh/config`, `.ssh/id_ed25519`, `.ssh/known_hosts`, `terraform.tf ...
show morescan of secrets (`.svn/entries`, `.ssh/config`, `.ssh/id_ed25519`, `.ssh/known_hosts`, `terraform.tfstate`, `.claude.json`, `core/.env`) + target CMS
show less
Web App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.