Cloudflare WAF custom rule blocked all (403, nothing reached origin). ~1,040 requests in a burst at ...
show moreCloudflare WAF custom rule blocked all (403, nothing reached origin). ~1,040 requests in a burst at 2026-10-10 16:24 UTC. Probing for secrets (.env, GCP service account keys) via path traversal and known exploit paths (Vite @fs CVE-2025-30208, Kibana CVE-2018-17246). UA rotated between AI crawler names within the same second; none verified by Cloudflare. Source is a Google Cloud VM, not a real crawler.
Sample (UTC 16:24:05-06):
GET /@fs/.env
GET /config/.env UA: GrokBot/1.0 (+https://x.ai/)
GET /panel/.env UA: Meta-WebIndexer/1.0
GET /gcp-service.json UA: Bytespider
GET /userfiles?path=../../../.env UA: DuckAssistBot/1.1
GET /cache/original/%2e%2e/.env UA: Meta-ExternalAgent/1.0
GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env UA: Meta-ExternalFetcher/1.0
GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../proc/self/environ UA: Kimi-SearchBot/1.0
Also: /google-services.json /sa.json /auth/.env
show less
2026-09-26 19:13 JST (UTC+9), IP 104.208.65.139 (AS8075 Microsoft / Azure East Asia, Hong Kong) sent ...
show more2026-09-26 19:13 JST (UTC+9), IP 104.208.65.139 (AS8075 Microsoft / Azure East Asia, Hong Kong) sent 55 GET requests to https://karasuma-an.work in a short burst. All blocked by Cloudflare custom WAF (403); origin not reached.
No User-Agent, no Referer, HTTP/1.1. Paths are non-standard PHP webshell/dropper probes, some under WordPress layout, e.g. /radio.php, /aa.php, /nauik.php, //av.php, /1xmomo.php, /vpn.php, /edit-tags.php, /Dss.php, //CAE-2.5.php, /wp-wpbak.php, /dairg.php, /wp-content/uploads/.
Not a browser session. Automated scan for leftover PHP on the host.
show less
2026-09-26 21:33 JST (UTC+9), IP 20.196.195.74 (AS8075 Microsoft / Azure Korea Central) sent 152 GET ...
show more2026-09-26 21:33 JST (UTC+9), IP 20.196.195.74 (AS8075 Microsoft / Azure Korea Central) sent 152 GET requests to https://karasuma-an.work in a short burst. All blocked by Cloudflare custom WAF (403); origin not reached.
No User-Agent, no Referer, HTTP/1.1. Paths are WordPress tree plus non-standard PHP (webshell/dropper probes), e.g. //naxc.php, /file.php, /images/all2.php, /.well-known/file.php, /.tmb/..., /wp-includes/css/well.php, /wp-content/index.php, /wp-content/plugins/hello..., randomized names under /wp-admin/css/, /wp-includes/js/, /wp-content/uploads/.
Not a browser session. Automated scan for leftover PHP/webshells on assumed WordPress layout.
show less
2026-09-14 13:07 and 14:52 JST. Target hosts: karasuma-an.work and sec.karasuma-an.work
IP 195.178. ...
show more2026-09-14 13:07 and 14:52 JST. Target hosts: karasuma-an.work and sec.karasuma-an.work
IP 195.178.110.137 AS48090 TECHOFF SRV LIMITED (DMZHOST), NL. No PTR.
Cloudflare custom WAF: 403 x24. Path only "/". Methods POST 17 / HEAD 7. Same Chrome/131 UA, no referrer.
Burst at 13:07:55 to sec. then ~1h45m later burst at 14:52:11 to apex. Parallel hits in the same second, not interactive use.
Same prefixes already abused this site. 2026-07-07 to 2026-09-05: 34 IPs / 432 blocked req from 45.148.10.0/24, 195.178.110.0/24 and 93.123.109.0/24 (wp-json, backup.sql, karasuma-an.tar.gz, .aws/config.old, scanner UAs). Provider mailed 2026-09-05. This IP is recurrence from 195.178.110.0/24.
show less
2026-09-09 18:58-18:59 JST. Target: karasuma-an.work
IP 34.21.140.21 AS396982 Google LLC (GCP VM, S ...
show more2026-09-09 18:58-18:59 JST. Target: karasuma-an.work
IP 34.21.140.21 AS396982 Google LLC (GCP VM, SG). PTR 21.140.21.34.bc.googleusercontent.com
Cloudflare custom WAF: 403. 349 requests from this IP in the filtered window.
Same host scanned credential/config paths in seconds, including:
/.env~ /_next/.env /htpasswd /id_rsa /gradle.properties /config.py /config.yaml /config.toml /secrets/gcp.json /backend/aws.json /config/service-account.json /admin
UA rotated each request and spoofed LinkedInBot, Facebook crawler, Perplexity-User, Claude-User, GPTBot, TelegramBot, Discordbot, Bytespider. Not official Googlebot (googleusercontent.com PTR).
Report is against a GCP-hosted scanner, not Google itself.
show less
Automated vulnerability scanning targeting Joomla and WordPress on karasuma-an.work.
Multiple reque ...
show moreAutomated vulnerability scanning targeting Joomla and WordPress on karasuma-an.work.
Multiple requests within the same second, rotating User-Agent per request
(macOS Safari / Linux Chrome / Windows Firefox), all blocked by WAF (403).
2026-09-11 21:14:40-41 JST (5 requests in ~1 second):
- GET / (referer: https://duckduckgo.com/, query: ?rest_route=/) — WordPress REST API probe
- GET /administrator/components/com_jce/ — Joomla JCE component probe
- GET /plugins/editors/jce/jce.xml — Joomla JCE editor vulnerability probe (CVE-2023-40514 family)
- GET /plugins/editors/jce/jce.xml (repeat)
- GET /media/system/js/core.js — Joomla core asset fingerprinting
Site runs neither Joomla nor WordPress. All requests returned 403 via custom
firewall rule. ASN 53667 (FranTech Solutions / Nefficient).
show less
Brute-ForceWeb App AttackHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.