MediumOpenOppora#1
Scanning from 203.0.113.23
Requests for files the site doesn't have (/.env, /wp-admin…): a bot looking for weaknesses.
What to do
- Usually harmless noise, but check none of the paths returned 200.
- Make sure files like .env or .git are never served by the site.
Demo: Acknowledge and Resolve are switched off here. In the real dashboard they work.
Evidence · 9 events
| Time (IST) | Source | Event | Who | IP | Where |
|---|---|---|---|---|---|
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / | |
| Oppora | Suspicious path | — | 203.0.113.23 CN | GET / |
- Suspicious pathOppora
· 203.0.113.23 CN
GET /
vendor/ phpunit/ phpunit/ src/ Util/ PHP/ eval-stdin.php · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
backup.sql · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
server-status · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
xmlrpc.php · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
phpmyadmin/ · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
wp-login.php · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
wp-admin/ · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
.git/ config · 404 - Suspicious pathOppora
· 203.0.113.23 CN
GET /
.env · 404
Details
- MITRE ATT&CK
- T1595 Active Scanning(opens in a new tab)
- About
- 203.0.113.23
- First seen
- 02 Nov, 03:00:56 IST
- Last seen
- 02 Nov, 03:01:20 IST
Timeline
IST
Alert raised (medium) with 1 event
IST
8 more events, up to 03:01:20
Demo: notes are switched off here. In the real dashboard they work.