# Notable paths, 2026-08-24 to 2026-08-31

/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  -- PHPUnit RCE swarm, 3 days, fleet-wide; NightAgent POST variant carries <?php echo "NightAgent";?>
/v2/_catalog  -- Docker Registry catalog enumeration (registry-hunt campaign)
/v2/internal/api-gateway/tags/list  -- internal registry enumeration (registry-hunt)
/v2/internal/api-gateway/manifests/latest  -- internal registry enumeration (registry-hunt)
/v2/internal/auth-service/tags/list  -- internal registry enumeration (registry-hunt)
/console/  -- WebLogic console login probe (registry-hunt journey step)
/login.action  -- Confluence login probe (registry-hunt journey step)
/___proxy_subdomain_whm/login, /___proxy_subdomain_cpanel  -- WHM/cPanel proxy-subdomain probes
/xmlrpc.php  -- 8,146 POST brute in 31 minutes (34.63.40.186, GCP)
/wp-json/batch/v1  -- WordPress batch abuse; forged X-Forwarded-For: 127.0.0.1 on all requests; SQLi multiplex variant carries UNION SELECT with CONCAT(0x7c7c, HEX(...), 0x7c7c)
/fetch, /proxy  -- SSRF proxy discovery (metadata-hunt campaign)
/.mcp.json  -- MCP endpoint discovery probe
/@fs/etc/passwd, /@fs/proc/self/environ  -- Vite dev-server traversal probes
/global-protect/login.esp  -- Palo Alto GlobalProtect login brute (176.120.22.43)
/+CSCOE+/logon.html  -- Cisco ASA clientless VPN login probe (176.120.22.43)
/api/checkin  -- beacon checkin (FLOKINET 185.100.87.136)
/eventmanager  -- beacon poll (FLOKINET 185.100.87.136)
/api/client/update?arch=amd64&commit=08059e95dacaf  -- beacon update pull (FLOKINET 185.100.87.136)
/v1/getinfo  -- high-port agent info request (AEZA 147.45.71.214)
http://azenv.net/  -- proxy validation target (PFCLOUD 204.76.203.7)
/1.bat, /0x83911d24Fx.sh, /.tygahhh/ENCRYPTED.ps1  -- malware dropper dictionary samples (169.150.201.29)
/.env, /.aws/credentials, /.azure/credentials, /tfstate, /firebase.json  -- credential harvest sweep paths (CREDSWEEP)