🇧🇪
34.76.27.30
05 Nov 2026
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud ...
show more
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud Platform (34.76.27.30) multiplexed over HTTP/2:
- Targeted discovery of Cloud, LLM, and developer secrets: /.aws/credentials, /.aws/config, /.aws/.env, /.claude/settings.json, /.cursor/mcp.json, /.boto, /.amplifyrc, /credentials, /credentials.json, /credentials.ini, /secrets.json, /auth.json, /sentry.properties, /sendgrid.env
- Spring Boot Actuator environment exploitation: /actuator/env, /api/actuator/env
- Git source metadata and CI/CD pipelines: /.git/config, /.git/logs/HEAD, /.git/logs/refs/heads/main, /.git-credentials, /.gitlab-ci.yml, /.github/workflows/deploy.yml, /.gitmodules, /.npmrc, /.netrc
- Environment file dictionary fuzzing across web roots and subdirectories: /.env*, /app/.env, /api/.env, /backend/.env, /laravel/.env, /cms/.env, /config/.env, /core/.env, /demo/.env, /dev/.env, /frontend/.env, /media/.env, /new/.env, /old/.env, /production/.env, /public/.e
show less
Bad Web Bot
Web App Attack
Port Scan
🇳🇱
172.94.9.12
04 Nov 2026
Automated web server reconnaissance, service fingerprinting, and HTTP verb tampering scan originatin ...
show more
Automated web server reconnaissance, service fingerprinting, and HTTP verb tampering scan originating from 172.94.9.12 targeting resolved PTR hostname syn-072-133-035-076.res.spectrum.com:
- Executing Nmap Scripting Engine (User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html))
- HTTP verb enumeration and method fuzzing: OPTIONS (CORS preflight checks for PUT, POST, DELETE, TRACE, PATCH, CONNECT), PROPFIND (WebDAV enumeration), and pseudo-random verb TAKI (http-methods.nse)
- Device and service fingerprinting targeting /HNAP1, /sdk (VMware), /evox/about, and Cisco AnyConnect SSL VPN probes
- Source control reconnaissance targeting /.git/HEAD (aborted at perimeter with status 0)
show less
Bad Web Bot
Port Scan
🇨🇦
62.93.167.144
31 Oct 2026
Automated multi-vector credential harvesting, API discovery, and brute-force campaign originating fr ...
show more
Automated multi-vector credential harvesting, API discovery, and brute-force campaign originating from 62.93.167.144:
- Spoofing iOS 18 Safari browser headers (Sec-Fetch-*, Priority) over multiplexed HTTP/2
- Targeted credential stuffing against login and data endpoints: /login, /api/login, /api/v1/login, /graphql, /contact (51-byte JSON payloads)
- Remote Code Execution probing: /_ignition/execute-solution (Laravel Ignition CVE-2021-3129), /app_dev.php, /debug.php
- Sensitive secret and environment harvesting: /.env*, /app/.env, /api/.env, /backend/.env, /laravel/.env, /.git/config, /.git/HEAD, /.dockerenv, /docker-compose*.yml, /Dockerfile
- API and diagnostic enumeration: /api/swagger, /api/documentation, /api/v1/, /phpinfo*, /info.php, /sysinfo.php
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇺🇸
184.185.26.51
30 Oct 2026
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtai ...
show more
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtail-http) originating from Frontier Communications (184.185.26.51) :
- Apache HTTP 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across multiple endpoints (.world, .hello, .php) delivering 229-byte stager
- Exploitation attempt targeting PHPUnit eval-stdin.php (CVE-2017-9841)
show less
Bad Web Bot
Web App Attack
Hacking
🇧🇷
177.10.160.46
28 Oct 2026
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtai ...
show more
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtail-http) originating from 177.10.160.46 :
- Apache HTTP 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across multiple endpoints (.world, .hello, .php) delivering 229-byte stager
- Exploitation attempt targeting PHPUnit eval-stdin.php (CVE-2017-9841)
show less
Bad Web Bot
Web App Attack
Hacking
🇧🇪
34.77.137.207
28 Oct 2026
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud ...
show more
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud Platform (34.77.137.207) multiplexed over HTTP/2 targeting hostname :
- Targeted discovery of Cloud, LLM, and developer secrets: /.aws/credentials, /.aws/credentials.bak, /.aws/config, /.aws/.env, /.boto, /.amplifyrc, /.claude/settings.json, /.claude/settings.local.json, /.cursor/mcp.json, /.env.openai, /.env.anthropic, /sendgrid.env, /credentials, /credentials.json, /credentials.ini, /secrets.json, /auth.json, /sentry.properties, /.htpasswd
- Git source metadata and CI/CD pipelines: /.git/config, /.git/index, /.git/logs/HEAD, /.git/logs/refs/heads/main, /.git-credentials, /.gitlab-ci.yml, /.github/workflows/deploy.yml, /.gitmodules, /.npmrc, /.netrc
- Environment file dictionary fuzzing across web roots and subdirectories: /.env*, /.env.backup, /.env.bak, /.env.dev, /.env.development, /.env.dist, /.env.docker, /.env.example, /.env.live, /.env.local, /.env.old, /.env.php, /.env.prod
show less
Bad Web Bot
Web App Attack
Port Scan
🇱🇹
77.90.185.244
27 Oct 2026
Automated credential harvesting and sensitive file exposure scan originating from Virtual Machine So ...
show more
Automated credential harvesting and sensitive file exposure scan originating from Virtual Machine Solutions LLC (77.90.185.244)
- Rotating User-Agent to Chrome OS (Mozilla/5.0 (X11; CrOS x86_64 10323.62.0) Chrome/65.0.3325.184)
- 404 canary validation via /osb1vmmpx6z2mf
- Multi-tier environment and credential fuzzing across directories: /.env*, /../.env, /backend/.env, /api/.env, /admin/.env, /app/.env, /server/.env, /dev/.env, /staging/.env, /production/.env, /laravel/.env, /sendgrid/.env, /crm/.env, /web/.env, /media/.env, /portal/.env, /dashboard/.env, /frontend/.env, /conf/.env, /public/.env, /vendor/.env, /cron/.env, /src/.env, /client/.env, /cgi-bin/.env, /private/.env, /backup/.env
- Probing for debug profilers and PHP diagnostic endpoints: /phpinfo/, /phpinfo.php, /info, /info/, /?phpinfo=-1, /app_dev.php/_profiler/open?file=app/config/parameters.yml, /app_dev.php/_profiler/phpinfo, /app_dev.php/_profiler/.env, /debug/default/view?panel=config
show less
Bad Web Bot
Web App Attack
Port Scan
🇱🇹
77.90.185.243
27 Oct 2026
Automated credential harvesting and sensitive file exposure scan from Virtual Machine Solutions LLC ...
show more
Automated credential harvesting and sensitive file exposure scan from Virtual Machine Solutions LLC (77.90.185.243) targeting IP 72.133.35.76:443:
- Extensive environment file dictionary fuzzing across web roots and subdirectories: /.env*, /../.env, /backend/.env, /api/.env, /admin/.env, /app/.env, /server/.env, /dev/.env, /staging/.env, /production/.env, /laravel/.env, /sendgrid/.env, /crm/.env, /web/.env, /media/.env, /portal/.env, /dashboard/.env, /frontend/.env, /conf/.env, /public/.env, /vendor/.env, /cron/.env, /src/.env, /client/.env, /cgi-bin/.env, /private/.env, /backup/.env
- Probing for PHP debug profilers and info endpoints: /phpinfo/, /phpinfo.php, /info, /info/, /?phpinfo=-1, /app_dev.php/_profiler/phpinfo, /app_dev.php/_profiler/.env, /debug/default/view?panel=config
- Application, backup, and framework configuration discovery: /site.zip, /appsettings.json, /docker-compose.yml, /wp-config.php, /secrets.env, /sendgrid.env, /config.env
show less
Bad Web Bot
Web App Attack
Port Scan
🇧🇪
34.76.228.45
26 Oct 2026
Automated web server reconnaissance and HTTP method tampering scan originating from Google Cloud Pla ...
show more
Automated web server reconnaissance and HTTP method tampering scan originating from Google Cloud Platform (34.76.228.45) targeting raw IP 72.133.35.76:
- Service & banner discovery using Nmap NSE (User-Agent: Mozilla/5.0 (compatible; nmap-http-info))
- HTTP method enumeration and fuzzing testing OPTIONS, GET, HEAD, POST, and randomized verb AUAC (http-methods.nse)
- Icon hash discovery targeting /favicon.ico
show less
Bad Web Bot
Port Scan
🇺🇸
185.190.56.235
25 Oct 2026
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtai ...
show more
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtail-http) originating from Virtual Machine Solutions LLC (185.190.56.235) targeting IP 72.133.35.76:443:
- Apache HTTP 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across arbitrary extensions (.world, .hello, .php)
- Directory enumeration and RCE targeting PHPUnit eval-stdin.php (CVE-2017-9841) across 26 common web paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /api, /demo, /cms, /crm, /admin, /backup, /blog, /workspace/drupal, etc.)
- ThinkPHP 5.x invocation RCE verification using call_user_func_array / md5
- PHP Local File Inclusion / pearcmd arbitrary file creation writing a backdoor to /tmp/index1.php, followed by execution
- Unauthenticated Docker Engine REST API probe via /containers/json
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇧🇪
34.52.133.111
24 Oct 2026
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud ...
show more
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud Platform (34.52.133.111) multiplexed over HTTP/2 targeting hostname widucrider.ddns.net:
- Targeted discovery of Cloud, LLM, and developer secrets: /.aws/credentials, /.aws/credentials.bak, /.aws/config, /.aws/.env, /.boto, /.amplifyrc, /.claude/settings.json, /.claude/settings.local.json, /.cursor/mcp.json, /.env.openai, /.env.anthropic, /sendgrid.env, /credentials, /credentials.json, /credentials.ini, /secrets.json, /auth.json, /sentry.properties
- Git source metadata and CI/CD pipelines: /.git/config, /.git/index, /.git/logs/HEAD, /.git/logs/refs/heads/main, /.git-credentials, /.gitlab-ci.yml, /.github/workflows/deploy.yml, /.gitmodules, /.npmrc, /.netrc
- Environment file dictionary fuzzing across web roots and subdirectories: /.env*, /.env.backup, /.env.bak, /.env.dev, /.env.development, /.env.dist, /.env.docker, /.env.example, /.env.live, /.env.local, /.env.old, /.env.php, /.env.prod, /.env.production
show less
Bad Web Bot
Web App Attack
Port Scan
🇪🇹
196.189.236.67
24 Oct 2026
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtai ...
show more
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtail-http) originating from 196.189.236.67 targeting IP 72.133.35.76:443:
- Apache HTTP 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across arbitrary extensions (.world, .hello, .php)
- Directory enumeration and RCE targeting PHPUnit eval-stdin.php (CVE-2017-9841) across 26 common web paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /api, /demo, /cms, /crm, /admin, /backup, /blog, /workspace/drupal, etc.)
- ThinkPHP 5.x invocation RCE verification using call_user_func_array / md5
- PHP Local File Inclusion / pearcmd arbitrary file creation writing a backdoor to /tmp/index1.php, followed by execution
- Unauthenticated Docker Engine REST API probe via /containers/json
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇨🇱
190.171.189.85
22 Oct 2026
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtai ...
show more
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtail-http) attempting unauthenticated Remote Code Execution (RCE), arbitrary file write, and container reconnaissance:
- Apache HTTP 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across multiple extensions (.world, .hello, .php)
- Directory enumeration and RCE targeting PHPUnit eval-stdin.php (CVE-2017-9841) across 26 common web paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /api, /demo, /cms, /crm, /admin, /backup, /blog, /workspace/drupal, etc.)
- ThinkPHP 5.x invocation RCE verification using call_user_func_array / md5
- PHP Local File Inclusion / pearcmd arbitrary file creation writing a backdoor to /tmp/index1.php, followed by execution
- Unauthenticated Docker Engine REST API probe via /containers/json
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇧🇷
212.18.114.31
21 Oct 2026
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtai ...
show more
Automated multi-vector exploit campaign from the RedTail cryptojacking botnet (User-Agent: libredtail-http) attempting unauthenticated Remote Code Execution (RCE), arbitrary file write, and container reconnaissance:
- Apache HTTP 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across multiple extensions (.world, .hello, .php)
- Directory enumeration and RCE targeting PHPUnit eval-stdin.php (CVE-2017-9841) across 26 common web paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /api, /demo, /cms, /crm, /admin, /backup, /blog, /workspace/drupal, etc.)
- ThinkPHP 5.x invocation RCE verification using call_user_func_array / md5
- PHP Local File Inclusion / pearcmd arbitrary file creation writing a backdoor to /tmp/index1.php, followed by execution
- Unauthenticated Docker Engine REST API probe via /containers/json
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇩🇪
185.73.23.168
20 Oct 2026
Automated web measurement crawl by academic research fleet (Ruhr University Bochum / winston.softsec ...
show more
Automated web measurement crawl by academic research fleet (Ruhr University Bochum / winston.softsec.ruhr-uni-bochum.de) targeting IP 72.133.35.76 with mismatched third-party Host/SNI headers:
- Source IP: 185.73.23.168 sending HTTP/1.1 GET requests using User-Agent "Software Security Research/1.0"
- Sending mismatched e-commerce and commercial domain headers (www.pch.com, us.checkout.gymshark.com, www.toysrus.com, www.dickies.com, www.canterbury.com, burningman.org, boseprofessional.com, etc.) against an unrelated server IP due to stale CDN/DNS mapping.
- Concurrent scan observed from 134.33.66.210 (zgrab) probing for MS Exchange eDiscovery export tool.
show less
Bad Web Bot
Port Scan
🇧🇩
103.133.201.241
19 Oct 2026
Automated multi-vector vulnerability sweep by RedTail cryptomining botnet (User-Agent: libredtail-ht ...
show more
Automated multi-vector vulnerability sweep by RedTail cryptomining botnet (User-Agent: libredtail-http) attempting unauthenticated Remote Code Execution (RCE), arbitrary file write, and Docker daemon discovery:
- Apache 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across multiple extensions
- Brute-force probing for PHPUnit eval-stdin.php RCE (CVE-2017-9841) across 26 common web paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /api, /demo, /cms, /crm, /admin, /backup, /blog, /workspace/drupal, etc.)
- ThinkPHP 5.x invocation RCE verification using call_user_func_array / md5
- PHP Local File Inclusion / pearcmd arbitrary file creation writing a backdoor to /tmp/index1.php, followed by execution
- Unauthenticated Docker Engine REST API probe via /containers/json
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇩🇪
185.73.23.168
19 Oct 2026
Automated academic web measurement crawler (Ruhr University Bochum / winston.softsec.ruhr-uni-bochum ...
show more
Automated academic web measurement crawler (Ruhr University Bochum / winston.softsec.ruhr-uni-bochum.de) sending mismatched third-party Host/SNI requests:
- Source: 185.73.23.168 using User-Agent "Software Security Research/1.0"
- Sending GET requests for unrelated third-party domains (brulosophy.com, www.rollei.de, derschutze.com, rushfaster.com.au, eden-mobility.co.uk, etc.) against IP 72.133.35.76 due to stale DNS/CDN routing data.
show less
Bad Web Bot
Port Scan
🇧🇪
34.156.112.89
19 Oct 2026
Automated web server fingerprinting and HTTP verb tampering reconnaissance originating from Google C ...
show more
Automated web server fingerprinting and HTTP verb tampering reconnaissance originating from Google Cloud Platform (34.156.112.89) targeting root path (/) on raw IP 72.133.35.76:
- Probing HTTP method acceptance and protocol compliance using standard and non-standard verbs: OPTIONS, GET, HEAD, POST, and malformed verb DLDE
- Favicon discovery probe targeting /favicon.ico
- Generic automated scanner signature: User-Agent "Mozilla/5.0 (compatible)" over HTTP/1.1 with Connection: close
show less
Bad Web Bot
Port Scan
🇵🇾
186.182.105.49
12 Oct 2026
Automated multi-vector vulnerability sweep by RedTail cryptomining botnet (User-Agent: libredtail-ht ...
show more
Automated multi-vector vulnerability sweep by RedTail cryptomining botnet (User-Agent: libredtail-http) attempting unauthenticated Remote Code Execution (RCE), arbitrary file write, and Docker daemon discovery:
- Apache 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 / CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across multiple extensions
- Brute-force probing for PHPUnit eval-stdin.php RCE (CVE-2017-9841) across 26 common web paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /api, /demo, /cms, /crm, /admin, /backup, /blog, /workspace/drupal, etc.)
- ThinkPHP 5.x invocation RCE verification using call_user_func_array / md5
- PHP Local File Inclusion / pearcmd arbitrary file creation writing a backdoor to /tmp/index1.php, followed by execution
- Unauthenticated Docker Engine REST API probe via /containers/json
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇧🇪
34.14.99.143
11 Oct 2026
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud ...
show more
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud Platform (34.14.99.143) multiplexed over HTTP/2.0:
- Targeted discovery of cloud, LLM, and third-party API credentials: /.env*, /.env.aws, /.aws/credentials, /.aws/credentials.bak, /.aws/config, /.aws/.env, /.boto, /.amplifyrc, /.claude/settings.json, /.claude/settings.local.json, /.env.openai, /.env.anthropic, /sendgrid.env
- E-commerce and crash reporting configs: /.env.shopware, /shopware.json, /.env.vendure, /vendure.json, /.env.raygun, /raygun.json, /airbrake.json
- Source control metadata and CI/CD pipelines: /.git/config, /.git/index, /.git/logs/HEAD, /.git/logs/refs/heads/main, /.git-credentials, /.gitlab-ci.yml, /.github/workflows/deploy.yml, /.gitmodules, /.npmrc
- Container and application configs: /.docker/.env, /.docker/config.json, /.docker/laravel/app/.env, /Dockerfile, /docker-compose.yml, /composer.json, /appsettings.json, /data
show less
Bad Web Bot
Web App Attack
Port Scan
🇨🇭
104.251.180.112
11 Oct 2026
Automated credential harvesting and sensitive file exposure scan using Go-http-client/1.1 from 104.2 ...
show more
Automated credential harvesting and sensitive file exposure scan using Go-http-client/1.1 from 104.251.180.112 targeting raw IP 72.133.35.76:
- Environment & deployment secrets: /.env*, /.env.local, /.env.production, /.env.dev, /.env.backup, /.env.bak, /.env.save, /.env.example
- Cloud and service credentials: /.aws/credentials, /.aws/config, /.aws_credentials, /service-account.json, /serviceAccountKey.json, /credentials.json
- Private keys and authentication files: /id_rsa, /.ssh/id_rsa, /private.key, /server.key, /.htpasswd, /.htaccess, /.npmrc, /.git-credentials
- Source repository metadata: /.git/config, /.git/HEAD
- Database dumps: /backup.sql, /dump.sql, /db.sql, /database.sql, /db_backup.sql
- Application & server configs: /config.json, /config.yml, /config.php, /settings.py, /appsettings.json, /parameters.yml, /docker-compose.yml, /wp-config.php.bak
show less
Bad Web Bot
Web App Attack
Port Scan
🇧🇪
35.205.116.134
10 Oct 2026
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud ...
show more
Automated credential harvesting and sensitive file reconnaissance scan originating from Google Cloud Platform (35.205.116.134) multiplexed over HTTP/2.0:
- Targeted discovery of cloud API credentials and secrets (.env*, /.aws/credentials, /.aws/credentials.bak, /.aws/config, /.aws/.env, /.boto, /.amplifyrc, /.claude/settings.json, /.claude/settings.local.json, /.env.openai, /.env.anthropic)
- Source control metadata and package configs (/.git/config, /.git/index, /.git-credentials, /.npmrc)
- Container and framework deployment configs (/.docker/.env, /.docker/config.json, /.docker/laravel/app/.env, /Dockerfile)
- Editor and temporary backup artifacts (/.env.backup, /.env.bak, /.env.dev, /.env.live, /.env.local, /.env.old, /.env.prod, /.env.sample, /.env.save, /.env.staging, /.env.swp, /.env~)
show less
Bad Web Bot
Web App Attack
Port Scan
🇧🇪
34.140.132.132
09 Oct 2026
Automated credential harvesting and sensitive file reconnaissance crawler hosted on Google Cloud (34 ...
show more
Automated credential harvesting and sensitive file reconnaissance crawler hosted on Google Cloud (34.140.132.132) multiplexed over HTTP/2.0:
- Targeted discovery of cloud API keys, secrets, and environment configurations: /.env*, /.env.aws, /.aws/credentials, /.aws/config, /.s3cfg, /.boto, /.env.openai, /.env.anthropic, /secrets.json, /credentials.json, /sendgrid.env, /appsettings.json
- Source control and CI/CD repository exposure checks: /.git/config, /.git/index, /.git/logs/HEAD, /.gitlab-ci.yml, /.github/workflows/deploy.yml
- Application frameworks and profilers: /_profiler/phpinfo, /api/phpinfo.php, /composer.json, /Dockerfile, /docker-compose.yml
- WordPress configuration backups: /wp-config.php.bak, /wp-content/debug.log
show less
Bad Web Bot
Web App Attack
Port Scan
🇺🇸
165.154.218.226
06 Oct 2026
Automated exploit scanning by RedTail cryptojacking botnet (User-Agent: libredtail-http) attempting ...
show more
Automated exploit scanning by RedTail cryptojacking botnet (User-Agent: libredtail-http) attempting unauthenticated Remote Code Execution (RCE) and path traversal across multiple known vectors:
- Apache HTTP 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 and CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across multiple extensions (.world, .hello, .php)
- Directory enumeration probing for PHPUnit eval-stdin.php RCE (CVE-2017-9841) across 30+ framework/subfolder paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /api, /demo, /cms, /crm, /admin, /backup, /blog, /workspace/drupal)
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking
🇺🇸
144.225.6.184
01 Oct 2026
Automated exploit scan by the RedTail cryptojacking botnet (User-Agent: libredtail-http) attempting ...
show more
Automated exploit scan by the RedTail cryptojacking botnet (User-Agent: libredtail-http) attempting unauthenticated Remote Code Execution (RCE) and path traversal across multiple vectors:
- Apache 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 and CVE-2012-1823) using soft-hyphen (%ADd) and -d auto_prepend_file=php://input across arbitrary extensions (.world, .hello, .php)
- Directory enumeration probing for PHPUnit eval-stdin.php RCE (CVE-2017-9841) across multiple common application paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /tests, /api, /demo, /cms, /crm, /admin)
show less
Bad Web Bot
Web App Attack
Port Scan
Hacking