Automated credential harvesting and sensitive file discovery scan multiplexed over HTTP/2.0 using a ...
show moreAutomated credential harvesting and sensitive file discovery scan multiplexed over HTTP/2.0 using a spoofed legacy User-Agent (Safari 3.0.2 on PPC Mac OS X).
The crawler executed 50+ rapid GET requests probing for:
- Environment and secrets configuration files across root and common app subdirectories (/.env, /api/.env, /backend/.env, /laravel/.env, /config/.env, /secrets.env, /sendgrid.env, /appsettings.json, /docker-compose.yml)
- Backup and editor artifact variants (/.env.save, /.env.bak, /.env.example, /.env.production, /.env.local)
- Path traversal sequences (/../.env, /../../.env)
- Exposed debug profilers and diagnostic scripts (Symfony profiler /app_dev.php, Yii debug toolbar /debug/default/view, /phpinfo.php, /_profiler/phpinfo)
- CMS/framework configs (/wp-config.php, app/config/parameters.yml)
show less
Automated web vulnerability scan (RedTail botnet / libredtail-http) attempting unauthenticated Remot ...
show moreAutomated web vulnerability scan (RedTail botnet / libredtail-http) attempting unauthenticated Remote Code Execution (RCE) and directory traversal across multiple known vectors:
- Apache 2.4.49/2.4.50 Path Traversal to CGI shell (CVE-2021-41773 / CVE-2021-42013) via /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 and CVE-2012-1823) using %ADd and -d auto_prepend_file=php://input with payloads across various extensions (.world, .hello, .php)
- Exhaustive brute-force probing for PHPUnit eval-stdin.php RCE (CVE-2017-9841) across common framework/subfolder web paths (/vendor, /lib, /laravel, /www, /ws, /yii, /zend, /tests, etc.)
show less
Automated web exploit scanning (RedTail botnet / libredtail-http) probing for multiple critical Remo ...
show moreAutomated web exploit scanning (RedTail botnet / libredtail-http) probing for multiple critical Remote Code Execution (RCE) and path traversal vulnerabilities:
- Apache HTTP Server 2.4.49/2.4.50 Path Traversal / RCE (CVE-2021-41773 / CVE-2021-42013) targeting /cgi-bin/.%2e/.../bin/sh
- PHP-CGI Argument Injection (CVE-2024-4577 and CVE-2012-1823) using %ADd and -d auto_prepend_file=php://input to achieve arbitrary code execution via POST body
- PHPUnit eval-stdin.php RCE (CVE-2017-9841)
show less
Automated RedTail botnet/malware scanner using User-Agent 'libredtail-http'. Probing direct IP on po ...
show moreAutomated RedTail botnet/malware scanner using User-Agent 'libredtail-http'. Probing direct IP on port 443 for multiple known RCE vectors: Apache cgi-bin path traversal to /bin/sh (CVE-2021-41773), PHP-CGI argument injection via %ADd allow_url_include (CVE-2024-4577), and extensive directory fuzzing for PHPUnit eval-stdin.php RCE (CVE-2017-9841).
show less
Brute-ForceBad Web BotWeb App AttackSQL InjectionHacking
Automated scanner probing for sensitive file disclosure, cloud credentials, and directory traversal. ...
show moreAutomated scanner probing for sensitive file disclosure, cloud credentials, and directory traversal. Rotating spoofed User-Agents (ClaudeBot, GPTBot, TelegramBot, GrokBot) targeting: /.env*, AWS/Azure/GCP credentials, /accessKeys.csv, /proc/self/environ. All requests targeted direct IP on port 443.
show less
Brute-ForceBad Web BotWeb App AttackHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.