Trying to read .env files?

[haleyngonadi]

Trying to read .env files?

[MikePriceAero]

Just bumping this on behalf of myself and @haleyngonadi (as well as anyone else who's experienced it and hasn't reported) - it's happening to me today on an Expose Pro subdomain I'm using for the very first time. No-one except me knows it even exists, so how is this happening?

[MikePriceAero]

Just been seeing the same thing happening to me as well - not sure how it would know what subdomain I'm using given it's not indexing anywhere in Google and I don't think just scanning IP addresses would lead to this?

[isokcevic]

Bumping this, as another pro user.. This is a very bad look, especially with silence from the dev.

Some of the originating IPs can be found on blacklists when googling as well.

I am stopping usage of this tool until a reasonable explanation for this behavior is provided. Wrote to support as well.

[sschlein]

Hi all, this is actually the open yource repository of the client and please raise these types of issues via our support inbox so that we can answer them quickly.

While we are looking into ways to block requests based on a IP list, these are typical requests of malicious bots that scan random URLs on the internet. If you check the logs of your normal web server of your application, you'll also find them. Luckily, Laravel is secure enough by default that this is not an issue and more an annoyance.

So if you encounter these scans, please create a support ticket by emailing us the information, your subdomain at that time and the Expose server region to [email protected] and we'll block the IP for future requests asap.

I am closing this ticket because that's not an issue in this repository here but with the global network that we manage. If you come to this issue via a google search, please raise a support ticket via email with the requested information.

Thanks

[sschlein]

To give you even more information:

There are sites that monitor certificates that are created by let's encyrpt. They publish them for transparency reasons and all certificates that you create with them are also monitored. Sites like https://leakix.net/ use this data to automatically scan all sites that use these certificates and this is why you sometimes get requests from them.

As mentioned, we've working on solutions to block their bots but there is like an infinite number of services like this and so it's quite hard to block all of them.