1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
# Notable paths, 2026-08-24 to 2026-08-31
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE swarm, 3 days, fleet-wide; NightAgent POST variant carries <?php echo "NightAgent";?>
/v2/_catalog -- Docker Registry catalog enumeration (registry-hunt campaign)
/v2/internal/api-gateway/tags/list -- internal registry enumeration (registry-hunt)
/v2/internal/api-gateway/manifests/latest -- internal registry enumeration (registry-hunt)
/v2/internal/auth-service/tags/list -- internal registry enumeration (registry-hunt)
/console/ -- WebLogic console login probe (registry-hunt journey step)
/login.action -- Confluence login probe (registry-hunt journey step)
/___proxy_subdomain_whm/login, /___proxy_subdomain_cpanel -- WHM/cPanel proxy-subdomain probes
/xmlrpc.php -- 8,146 POST brute in 31 minutes (34.63.40.186, GCP)
/wp-json/batch/v1 -- WordPress batch abuse; forged X-Forwarded-For: 127.0.0.1 on all requests; SQLi multiplex variant carries UNION SELECT with CONCAT(0x7c7c, HEX(...), 0x7c7c)
/fetch, /proxy -- SSRF proxy discovery (metadata-hunt campaign)
/.mcp.json -- MCP endpoint discovery probe
/@fs/etc/passwd, /@fs/proc/self/environ -- Vite dev-server traversal probes
/global-protect/login.esp -- Palo Alto GlobalProtect login brute (176.120.22.43)
/+CSCOE+/logon.html -- Cisco ASA clientless VPN login probe (176.120.22.43)
/api/checkin -- beacon checkin (FLOKINET 185.100.87.136)
/eventmanager -- beacon poll (FLOKINET 185.100.87.136)
/api/client/update?arch=amd64&commit=08059e95dacaf -- beacon update pull (FLOKINET 185.100.87.136)
/v1/getinfo -- high-port agent info request (AEZA 147.45.71.214)
http://azenv.net/ -- proxy validation target (PFCLOUD 204.76.203.7)
/1.bat, /0x83911d24Fx.sh, /.tygahhh/ENCRYPTED.ps1 -- malware dropper dictionary samples (169.150.201.29)
/.env, /.aws/credentials, /.azure/credentials, /tfstate, /firebase.json -- credential harvest sweep paths (CREDSWEEP)
|
