BotLens

Detect web bots, decode what they want, and spot the ones working together.

NETWORK CLUSTER Low confidence

Secret & credential harvesting

2 sources inside AS396982 Google LLC (BE) ran secret & credential harvesting with different client fingerprints against /staging/.env, /web/.env, /v2/.env. Possibly one operator spreading requests across servers in the same cloud.

2 sources · 1 network · BE · 133 hits · last 12h ago

Evidence: same network and intent (AS396982); overlapping targets; cloud networks host many unrelated customers

300Bots logged

172Hostile

16Campaigns

15Networks

Suspected coordinated activity

Findings are similarity-based, drawn from the last 300 logged events. They are leads to investigate, not proof of who is behind them.

NETWORK CLUSTER Low Secret & credential harvesting

2 sources · 1 network · 133 hits · 27h ago → 12h ago

Evidence: same network and intent (AS396982); overlapping targets; cloud networks host many unrelated customers

Targets: /staging/.env /web/.env /v2/.env /v1/.env /test/.env

SCANNER SWEEP High Secret & credential harvesting

1 source · 1 network · 81 hits · 27h ago → 27h ago

Evidence: 78 different paths from one source; 3 intent categories

Targets: /wp-content/debug.log /vendor/composer/installed.json /staging/.env /web/.env /v1/.env

SCANNER SWEEP High Secret & credential harvesting

1 source · 1 network · 68 hits · 12h ago → 12h ago

Evidence: 68 different paths from one source; 3 intent categories

Targets: /.github/token /wp-content/debug.log /.gitlab/token /web/.env /vendor/composer/installed.json

SCANNER SWEEP High Admin login brute forcing

1 source · 1 network · 101 hits · 21h ago → 21h ago

Evidence: 101 different paths from one source; 4 intent categories

Targets: /wp-content/upgrade/ /wp-admin/ /wp-admin/includes/ /wp-content/themes/ /wp-content/plugins/

What to do: If you run a real login page, add rate limiting and MFA.

NETWORK CLUSTER Low Debug & info-leak exposure

2 sources · 1 network · 13 hits · 27h ago → 12h ago

Evidence: same network and intent (AS396982); overlapping targets; cloud networks host many unrelated customers

Targets: /wp-content/debug.log /phpinfo /phpinfo.php /info.php /api/phpinfo.php

What to do: Make sure no debug or profiler routes are reachable in production.

NETWORK CLUSTER Low WordPress probing

2 sources · 1 network · 8 hits · 22h ago → 16h ago

Evidence: same network and intent (AS9009); overlapping targets; cloud networks host many unrelated customers

Targets: / /wp-json/wp/v2/users/ /wp-includes/wlwmanifest.xml

What to do: If you run WordPress, keep core and plugins updated and block /xmlrpc.php. If you don't, there is nothing to fix.

NETWORK CLUSTER Low Admin login brute forcing

2 sources · 1 network · 4 hits · 22h ago → 16h ago

Evidence: same network and intent (AS9009); overlapping targets; cloud networks host many unrelated customers

Targets: /xmlrpc.php

What to do: If you run a real login page, add rate limiting and MFA.

SCANNER SWEEP High Admin login brute forcing

1 source · 1 network · 7 hits · 9h ago → 9h ago

Evidence: 6 different paths from one source; 1 intent categories

Targets: /login/ /admin/ /wp-login.php /account/login/ /user/login/

What to do: If you run a real login page, add rate limiting and MFA.

SCANNER SWEEP Medium Admin login brute forcing

1 source · 1 network · 6 hits · 16h ago → 16h ago

Evidence: 4 different paths from one source; 2 intent categories

Targets: /xmlrpc.php / /wp-json/wp/v2/users/ /wp-includes/wlwmanifest.xml

What to do: If you run a real login page, add rate limiting and MFA.

SCANNER SWEEP Medium Admin login brute forcing

1 source · 1 network · 6 hits · 22h ago → 22h ago

Evidence: 4 different paths from one source; 2 intent categories

Targets: /xmlrpc.php / /wp-json/wp/v2/users/ /wp-includes/wlwmanifest.xml

What to do: If you run a real login page, add rate limiting and MFA.

SCANNER SWEEP High CMS & software fingerprinting

1 source · 1 network · 10 hits · 2h ago → 2h ago

Evidence: 10 different paths from one source; 1 intent categories

Targets: /wp-content/plugins/the-grid/langs/readme.txt /wp-content/plugins/user-registration/readme.txt /wp-content/plugins/everest-forms/readme.txt /wp-content/plugins/ultimate-member/readme.txt /wp-content/plugins/divi-form-builder/changelog.txt

NETWORK CLUSTER Low CMS & software fingerprinting

2 sources · 1 network · 3 hits · 27h ago → 12h ago

Evidence: same network and intent (AS396982); overlapping targets; cloud networks host many unrelated customers

Targets: /vendor/composer/installed.json

NETWORK CLUSTER Medium Content discovery crawl

4 sources · 1 network · 4 hits · 20h ago → 76m ago

Evidence: same network and intent (AS14618); 4 sources; overlapping targets; cloud networks host many unrelated customers

Targets: /robots.txt

SUSPECTED COORDINATION High Content discovery crawl

3 sources · 1 network · 3 hits · 20h ago → 76m ago

Evidence: same client fingerprint; all from one network (AS14618); overlapping targets; distinctive client software

Targets: /robots.txt

SUSPECTED COORDINATION High Content discovery crawl

3 sources · 1 network · 3 hits · 12h ago → 7h ago

Evidence: same client fingerprint; all from one network (AS15169); overlapping targets; distinctive client software

Targets: /robots.txt

NETWORK CLUSTER Low Unclassified automated access

2 sources · 1 network · 4 hits · 9h ago → 8h ago

Evidence: same network and intent (AS14618); overlapping targets; cloud networks host many unrelated customers

Targets: /favicon.png /favicon.ico

Recent bots

Benign Content discovery crawl

GET /robots.txt

216.73.216.x · US · AS16509 Anthropic, PBC · 1s ago

Benign Content discovery crawl

GET /robots.txt

52.203.246.x · US · AS14618 Amazon Technologies Inc. · 76m ago

Gray-area CMS & software fingerprinting

GET /wp-content/plugins/the-grid/langs/readme.txt