Report for IP: 8.234.239.146

This IP requested many different non-existent pages within a short window — the signature of an automated sweep working through a wordlist of guessed paths, regardless of which specific filenames it tried. A real visitor following broken links, or a search-engine crawler, never generates this volume of distinct 404s from one IP in under a minute.

This IP requested a .env file (or a variant like .env.local, .env.production) — files that commonly contain database credentials, API keys, and other secrets for a web application. No legitimate visitor ever requests this path; it is exclusively probed by attackers hunting for leaked configuration.

This IP's request contained a directory traversal sequence (../) in a query parameter — an attempt to escape the intended directory and read or include arbitrary files elsewhere on the server's filesystem.

This IP requested a dot-folder or file used by cloud CLIs, SSH, or AI coding tools to store credentials — AWS/GCP/Azure config, SSH private keys, .netrc, or a Claude/Codex/Cursor config folder. These never belong in a web root; a hit hands an attacker API keys or shell access outright. No legitimate visitor requests these paths.

This IP requested a root-level project or infrastructure file — docker-compose.yml, a Terraform state file, package.json, or a generic config/secrets.json — hunting for source code, deployment secrets, or infrastructure details accidentally left reachable over HTTP. No legitimate web visitor needs these.

This IP generated over 20 HTTP 4xx errors in 60 seconds using a User-Agent identified as a bad bot (scraper, headless browser, or attack proxy). The high error rate indicates automated probing for vulnerabilities while trying to appear as generic traffic. Legitimate services respect robots.txt and do not flood servers with errors.