BotLens

Decode a request →

Detect web bots, decode what they want, and spot the ones working together.

SCANNER SWEEP High confidence

Secret & credential harvesting

One source (93.123.109.x, NL, TECHOFF SRV LIMITED) tried 204 different paths covering api enumeration & scraping, cms & software fingerprinting, debug & info-leak exposure, admin login brute forcing, secret & credential harvesting. That looks like a single automated scan, not a person browsing.

1 source · 1 network · NL · 204 hits · last 50m ago
Evidence: 204 different paths from one source; 5 intent categories
300Bots logged
276Hostile
2Campaigns
9Networks

Suspected coordinated activity

Findings are similarity-based, drawn from the last 300 logged events. They are leads to investigate, not proof of who is behind them.

SCANNER SWEEP High Secret & credential harvesting
1 source · 1 network · 204 hits · 50m ago → 50m ago
Evidence: 204 different paths from one source; 5 intent categories
Targets: /swagger.js /server-status /server-info /logs/debug.log /login/laravel.log
SCANNER SWEEP High Secret & credential harvesting
1 source · 1 network · 81 hits · 36m ago → 36m ago
Evidence: 81 different paths from one source; 3 intent categories
Targets: /vendor/composer/installed.json /web/.env /v1/.env /wp-content/debug.log /v2/.env

Recent bots

Gray-area AI training / retrieval crawl (declared, unverified)
GET /
74.7.242.x · US · AS8075 Microsoft Limited · 79s ago
Hostile Secret & credential harvesting
GET /.git/config
45.153.102.x · US · AS203020 HostRoyale Technologies Pvt · 5m ago · seen 2× since 7m ago
Hostile Secret & credential harvesting
GET /.env.local
45.153.102.x · US · AS203020 HostRoyale Technologies Pvt · 5m ago · seen 2× since 7m ago
Hostile Secret & credential harvesting
GET /.env
45.153.102.x · US · AS203020 HostRoyale Technologies Pvt · 5m ago · seen 2× since 7m ago
Gray-area Unclassified automated access
GET /
2a09:bac6:5958::x · UA · AS13335 Cloudflare London, LLC · 14m ago · seen 2× since 50m ago
Gray-area Unclassified automated access
GET /
2604:a880:400::x · US · AS14061 DigitalOcean, LLC · 18m ago · seen 2× since 39m ago
Gray-area Unclassified automated access
GET /
57.129.136.x · GB · AS16276 OVH Ltd · 36m ago
Gray-area CMS & software fingerprinting
GET /vendor/composer/installed.json
34.156.64.x · BE · AS396982 Google LLC · 36m ago
Hostile Secret & credential harvesting
GET /web/.env
34.156.64.x · BE · AS396982 Google LLC · 36m ago
Hostile Secret & credential harvesting
GET /v1/.env
34.156.64.x · BE · AS396982 Google LLC · 36m ago
Hostile Debug & info-leak exposure
GET /wp-content/debug.log
34.156.64.x · BE · AS396982 Google LLC · 36m ago
Hostile Secret & credential harvesting
GET /v2/.env
34.156.64.x · BE · AS396982 Google LLC · 36m ago
Hostile Secret & credential harvesting
GET /test/.env
34.156.64.x · BE · AS396982 Google LLC · 36m ago
Hostile Secret & credential harvesting
GET /src/.env
34.156.64.x · BE · AS396982 Google LLC · 36m ago
Hostile Debug & info-leak exposure
GET /server-info
34.156.64.x · BE · AS396982 Google LLC · 36m ago