We deliver deliberation.
Feed Log out (ross)
← Back to feed

[CRITICAL] Caddy exploit attempts detected, 2026-05-25 06:00–08:01 MDT (mid-window alert)

critical caddy_audience window: 2026-05-25 06:00 MDT – 08:01 MDT posted: 2026-05-25 08:01 MDT http audience ops caddy critical exploit
What happened
Total traffic included 7740 requests from 717 unique IPs, dominated by 1136 bot/crawler sessions. Human activity was limited to 2 sessions, one of which engaged with content. The traffic composition is heavily skewed toward automated activity, but 12 specific exploit attempts were detected, including probing for XML-RPC, WordPress installation scripts, and exposure of configuration files like /.git/config and /.env.bak. The highest volume was driven by OpenAI (640 requests) and Anthropic (359 requests).
Narrative
Caddy audience digest for arc-codex.com, 2026-05-25 06:00 – 08:01 MDT. TRAFFIC OVERVIEW Total external requests: 7740 from 717 unique IPs over 4 hours. Operator activity: 141 requests from 1 operator IP(s) (38.175.170.87). Datacenter origin: 0.1% of external requests. AUDIENCE ESTIMATE Likely-human sessions: 2 (heuristic: real browser UA, non-datacenter IP, has referrer or direct content visit). Engaged sessions: 1 (loaded ≥1 article page, session duration ≥30s). Bot/crawler sessions: 1136. TOP REFERRERS m.facebook.com (4), facebook.com (1). TOP IPs BY VOLUME 74.7.241.22 (640 req); 216.73.216.51 (359 req); 216.244.66.198 (183 req). STATUS BREAKDOWN HTTP 200: 7646, HTTP 206: 1, HTTP 308: 46, HTTP 404: 39, HTTP 502: 8. EXPLOIT ATTEMPTS DETECTED (12 requests) Patterns: 35.239.90.70 → /xmlrpc.php?rsd; 104.23.221.162 → /wp-admin/install.php?step=1; 104.23.221.162 → /wp-admin/install.php?step=1; 5.255.104.83 → /.git/config; 5.255.104.83 → /.env.bak
Blue Team — Operational Summary
Total external requests amounted to 7740 over four hours from 717 unique IP addresses. The majority of traffic was successfully served (7646 HTTP 200 responses), with minor error rates including 39 HTTP 404s and 8 HTTP 502s. Human activity was minimal, logged as 2 likely sessions and 1 engaged session. The bulk of traffic consisted of 1136 bot/crawler sessions. Specific exploit attempts were identified across 12 requests targeting common web application vulnerabilities, including attempts to access XML-RPC endpoints, WordPress installation scripts, and Git configuration files. The observed traffic volume and the presence of targeted exploit attempts suggest a mix of general crawling and probing against application components.
Red Team — Facts Only
* Time window: 2026-05-25 06:00 – 08:01 MDT. * Total external requests: 7740 from 717 unique IPs. * Operator activity: 141 requests from 1 IP (38.175.170.87). * HTTP Status Codes: HTTP 200 (7646), HTTP 206 (1), HTTP 308 (46), HTTP 404 (39), HTTP 502 (8). * Audience: 2 likely-human sessions, 1 engaged session, 1136 bot/crawler sessions. * Exploit attempts detected: 12 requests identified. * Specific exploit patterns: * 35.239.90.70 → /xmlrpc.php?rsd * 104.23.221.162 → /wp-admin/install.php?step=1 (2 instances) * 5.255.104.83 → /.git/config * 5.255.104.83 → /.env.bak * Top IPs by volume: 74.7.241.22 (640 req), 216.73.216.51 (359 req), 216.244.66.198 (183 req).
Purple Team — Pattern Analysis
The traffic composition is heavily skewed towards automated activity (1136 bot sessions) and a small segment of targeted scanning. The 12 detected exploit attempts involving paths like `/xmlrpc.php` and WordPress installation scripts suggest external actors are actively probing for known application vulnerabilities rather than passively crawling. The specific files targeted (`.git/config`, `.env.bak`) indicate reconnaissance activity focused on source code and configuration exposure. The high volume of non-human traffic combined with the specific exploit attempts warrants attention, as these attempts may represent staged attacks or vulnerability scanning rather than typical bot behavior. The low rate of successful error responses (404s and 502s) relative to total requests suggests the application infrastructure is handling the probing, but the attack patterns themselves are the signal.
Counter-Analyst
This report suggests high bot activity, but the focus seems misaligned; we detected 12 specific exploit attempts targeting sensitive files and admin installs, yet the majority of the traffic volume comes from general crawling IPs. Should we be prioritizing the immediate response and blocking the 12 malicious attempts rather than focusing on the overall 7740 request count?
Structured Data
Total requests7740
Unique IPs717
Likely human sessions2
Engaged sessions1
Bot/crawler sessions1136
Datacenter %0.1
Top referrersm.facebook.com (4), facebook.com (1)
Top IPs74.7.241.22 (640); 216.73.216.51 (359); 216.244.66.198 (183)
Status breakdownHTTP 200: 7646, HTTP 206: 1, HTTP 308: 46, HTTP 404: 39, HTTP 502: 8
Exploit attempts35.239.90.70 → /xmlrpc.php?rsd; 104.23.221.162 → /wp-admin/install.php?step=1; 104.23.221.162 → /wp-admin/install.php?step=1; 5.255.104.83 → /.git/config; 5.255.104.83 → /.env.bak