Inbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/ ...
show moreInbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/IPS event.
Observed IDS/IPS evidence:
- ET EXPLOIT HackingTrio UA (Hello, World)
Target service: HTTP / TCP port 80
Severity: 9/10
First seen: 2026-10-08T15:25:51.436Z
Last seen: 2026-10-08T15:25:51.436Z
Reference: STI-20261008-172551-144-48-132-191
show less
Sensitive file and configuration probing detected against a public web server.
30 suspicious reques ...
show moreSensitive file and configuration probing detected against a public web server.
30 suspicious requests
30 critical requests
Observed requests:
GET /WEB-INF/classes/.env
GET /storybook-static/.env
GET /src/.env
GET /server/.env.production
GET /server/.env
Risk level: CRITICAL
Reference: STI-20261008-151101-217-60-242-58
show less
Automated web application probing detected against a public web server.
6 suspicious requests
2 cri ...
show moreAutomated web application probing detected against a public web server.
6 suspicious requests
2 critical requests
Observed requests:
GET /yich.php
GET /xm2l.php
GET /wp-mails.php
GET /wp-log.php
GET /wp-logis.php
Risk level: VERY_HIGH
Reference: STI-20261008-044104-104-208-73-227
show less
Git repository probing detected against a public web server.
34 suspicious requests
34 critical req ...
show moreGit repository probing detected against a public web server.
34 suspicious requests
34 critical requests
Observed requests:
GET /.git/config
GET /.env.test
GET /.env.staging
Risk level: CRITICAL
Reference: STI-20261007-181142-35-213-84-207
show less
WordPress exploitation attempts detected against a public web server.
10 suspicious requests
4 crit ...
show moreWordPress exploitation attempts detected against a public web server.
10 suspicious requests
4 critical requests
Observed requests:
GET /xleet.php
GET /ws54.php
GET /wp-content/plugins/hellopress/wp_filemanager.php
GET /wp-admin/
GET /wk/index.php
Risk level: CRITICAL
Reference: STI-20261007-171120-20-210-128-125
show less
WordPress exploitation attempts detected against a public web server.
12 suspicious requests
3 crit ...
show moreWordPress exploitation attempts detected against a public web server.
12 suspicious requests
3 critical requests
Observed requests:
GET /ws54.php
GET /wp-content/plugins/hellopress/wp_filemanager.php
GET /wp-admin/
GET /wk/index.php
GET /this_is_a_new_hello_world.php
Risk level: VERY_HIGH
Reference: STI-20261007-141120-4-196-65-241
show less
WordPress exploitation attempts detected against a public web server.
5 suspicious requests
2 criti ...
show moreWordPress exploitation attempts detected against a public web server.
5 suspicious requests
2 critical requests
Observed requests:
GET /z70.php
GET /z60.php?p=
GET /xxw.php
GET /wsd.php
GET /wp-content/plugins/hellopress/wp_filemanager.php
Risk level: VERY_HIGH
Reference: STI-20261007-111122-20-235-120-216
show less
Inbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/ ...
show moreInbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/IPS event.
Observed IDS/IPS evidence:
- ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (CVE-2021-42013) M2
Target service: HTTP / TCP port 80
Severity: 9/10
First seen: 2026-10-07T05:57:20.616Z
Last seen: 2026-10-07T05:57:20.616Z
Reference: STI-20261007-075720-165-99-207-153
show less
Sensitive file and configuration probing detected against a public web server.
90 suspicious reques ...
show moreSensitive file and configuration probing detected against a public web server.
90 suspicious requests
53 critical requests
Observed requests:
GET /webui/.env
GET /web/.env
GET /.vscode/settings.json
GET /.vscode/mcp.json
GET /.vscode/launch.json
Risk level: CRITICAL
Reference: STI-20261007-011112-161-118-229-234
show less
Inbound web command-execution attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked ...
show moreInbound web command-execution attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/IPS event.
Observed IDS/IPS evidence:
- ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt
Target service: HTTP / TCP port 80
Severity: 9/10
First seen: 2026-10-05T20:54:17.106Z
Last seen: 2026-10-05T20:54:17.106Z
Reference: STI-20261005-225417-144-225-6-184
show less
Git repository probing detected against a public web server.
37 suspicious requests
37 critical req ...
show moreGit repository probing detected against a public web server.
37 suspicious requests
37 critical requests
Observed requests:
GET /web/.env
GET /site/.env
GET /.git/config
Risk level: HIGH
Reference: STI-20261005-182510-35-211-253-95
show less
Inbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/ ...
show moreInbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/IPS event.
Observed IDS/IPS evidence:
- ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
Target service: HTTP / TCP port 80
Severity: 9/10
First seen: 2026-10-05T10:54:22.697Z
Last seen: 2026-10-05T10:54:22.697Z
Reference: STI-20261005-125422-162-35-120-21
show less
Git repository probing detected against a public web server.
20 suspicious requests
20 critical req ...
show moreGit repository probing detected against a public web server.
20 suspicious requests
20 critical requests
Observed requests:
GET /.git/config
GET /.env.test
GET /.env.staging
Risk level: HIGH
Reference: STI-20261005-092457-35-213-254-0
show less
Git repository probing detected against a public web server.
74 suspicious requests
74 critical req ...
show moreGit repository probing detected against a public web server.
74 suspicious requests
74 critical requests
Observed requests:
GET /web/.env
GET /site/.env
GET /.git/config
Risk level: HIGH
Reference: STI-20261005-085445-35-214-41-76
show less
WordPress exploitation attempts detected against a public web server.
78 suspicious requests
59 cri ...
show moreWordPress exploitation attempts detected against a public web server.
78 suspicious requests
59 critical requests
Observed requests:
GET /wp-content/debug.log
GET /wp-config.php.bak
GET /web/.env
GET /vendor/composer/installed.json
GET /v2/.env
Risk level: CRITICAL
Reference: STI-20261005-085446-35-241-239-86
show less
Automated web application probing detected against a public web server.
2 suspicious requests
2 cri ...
show moreAutomated web application probing detected against a public web server.
2 suspicious requests
2 critical requests
Observed requests:
GET /zwso.php
GET /yachi.php
GET /xivoefjr.php
GET /xcrarnkpo.php
GET /wpxml.php
Risk level: VERY_HIGH
Reference: STI-20261005-045431-20-197-26-46
show less
Sensitive file and configuration probing detected against a public web server.
125 suspicious reque ...
show moreSensitive file and configuration probing detected against a public web server.
125 suspicious requests
125 critical requests
Observed requests:
GET /www/.env
GET /web/.env
GET /var/www/html/.env
GET /var/www/.env
Risk level: VERY_HIGH
Reference: STI-20261005-035428-34-69-36-150
show less
WordPress exploitation attempts detected against a public web server.
57 suspicious requests
46 cri ...
show moreWordPress exploitation attempts detected against a public web server.
57 suspicious requests
46 critical requests
Observed requests:
GET /.yarnrc.yml
GET /wp-config.php.save
GET /wp-config.php.old
GET /wp-config.php~
GET /wp-config.php
Risk level: CRITICAL
Reference: STI-20261005-025420-54-207-116-2
show less
Automated web application probing detected against a public web server.
4 suspicious requests
2 cri ...
show moreAutomated web application probing detected against a public web server.
4 suspicious requests
2 critical requests
Observed requests:
GET /yich.php
GET /x.php
GET /wp-log.php
GET /wp-filemanager1_260805194013.php
GET /wp-fgban13jx3.php
Risk level: VERY_HIGH
Reference: STI-20261004-102450-20-219-185-206
show less
Automated web application probing detected against a public web server.
4 suspicious requests
2 cri ...
show moreAutomated web application probing detected against a public web server.
4 suspicious requests
2 critical requests
Observed requests:
GET /yich.php
GET /x.php
GET /wp-log.php
GET /wp-filemanager1_260805194013.php
GET /wp-fgban13jx3.php
Risk level: VERY_HIGH
Reference: STI-20261004-042421-13-70-107-184
show less
Automated web application probing detected against a public web server.
12 suspicious requests
3 cr ...
show moreAutomated web application probing detected against a public web server.
12 suspicious requests
3 critical requests
Observed requests:
GET /zero.php
GET /yich.php
GET /x.php
GET /wp-log.php
GET /wp-logis.php
Risk level: CRITICAL
Reference: STI-20261004-015423-20-210-186-186
show less
Automated web application probing detected against a public web server.
19 suspicious requests
11 c ...
show moreAutomated web application probing detected against a public web server.
19 suspicious requests
11 critical requests
Observed requests:
GET /ps-18daf6432b467294-1d7990-notfound
GET /_profiler/phpinfo
GET /phpinfo.php
GET /php_info.php
GET /phpinfo
Risk level: CRITICAL
Reference: STI-20261003-105419-45-138-12-53
show less
Git repository probing detected against a public web server.
22 suspicious requests
16 critical req ...
show moreGit repository probing detected against a public web server.
22 suspicious requests
16 critical requests
Observed requests:
GET /wp-config.php
GET /wp-config.php.bak
GET /.git/refs/heads/master
GET /.git/refs/heads/main
GET /.git/logs/HEAD
Risk level: HIGH
Reference: STI-20261003-035359-35-231-52-75
show less
Inbound malicious web activity detected and blocked by perimeter IDS/IPS.
Observed 10 blocked IDS/I ...
show moreInbound malicious web activity detected and blocked by perimeter IDS/IPS.
Observed 10 blocked IDS/IPS events.
Observed IDS/IPS evidence:
- ET USER_AGENTS Suspcious LeakIX User-Agent (l9explore)
Target service: HTTP/HTTPS / TCP port 80,443
Severity: 7/10
First seen: 2026-09-01T20:06:57.184Z
Last seen: 2026-10-02T15:16:24.261Z
Reference: STI-20261002-171624-193-32-204-199
show less
Sensitive file and configuration probing detected against a public web server.
27 suspicious reques ...
show moreSensitive file and configuration probing detected against a public web server.
27 suspicious requests
27 critical requests
Observed requests:
GET /.env.test
GET /.env.template
GET /.env.staging
GET /.env.sample
GET /.env.production
Risk level: CRITICAL
Reference: STI-20261002-165409-209-99-188-251
show less
Web App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.