A bot hunted my site for phpinfo.php. Here's what stopped it
In about ten seconds, a scanner tried dozens of paths looking for a page that leaks a server's setup. My firewall blocked every one before it reached my house.
- Goal
- Find out what was attacking my site, and check my defences held
- Result
- Every request blocked
- Tools
- Cloudflare WAF, Cloudflare GraphQL API, AbuseIPDB
What I saw
The day I added a feed of blocked requests to my live lab, the newest entries weren't my own tests. At 13:30 on 23 October something requested these, a few milliseconds apart:
/notifications/.env
/job/.env
/phpinfo.php.bak
/staging/phpinfo.php
/uat/phpinfo.php
/administrator/phpinfo.php
/docs/phpinfo.php
# ...and more like them, all within about 10 seconds
Every one was blocked by my Cloudflare rule for attack paths, so none of them reached the Pi.
What it was looking for
phpinfo.phpis a test page developers sometimes forget to delete. It shows a server's whole setup: software versions, file paths, and sometimes passwords stored in settings..envfiles are where apps often keep passwords and API keys. Leaving one where the web server can reach it is a common, serious mistake..bakfiles are old copies that might still contain the original code.
Folder names like staging, uat and docs are guesses from a word list. It doesn't know anything about my site. It's trying the same list everywhere.
Who was behind it
Cloudflare logs more detail than my public pages show, so I looked privately:
- Network: Google Cloud, in France. Not Google's search crawler, which identifies itself as Googlebot. Someone rented a cloud server and ran a scanner on it.
- User agent: claimed to be Chrome on Windows. A real browser can't request ten pages a second, so that's faked to look less suspicious.
- Target: almost certainly not me personally. New domains get found quickly because every HTTPS certificate is published in public logs, and scanners watch them.
Sites like AbuseIPDB collect reports about addresses that attack people, which is a quick way to see if a scanner is already known. I didn't scan it or try to attack it back. That would be illegal, even though it scanned me first.
Why nothing was at risk
- Cloudflare blocked it first. My rule blocks any path containing
.php,/.env,/.git,/wp-orphpmyadmin, so the requests never used my home connection. - There was nothing to find anyway. My site has no PHP, and the files with secrets (like the Cloudflare token) are root-only, outside the web folder.
Over five days my firewall blocked about 3,400 requests. 785 were my own rate limit test. The rest were bots like this one.
What I learned
- A public website gets scanned within days, even a small one nobody has heard of.
- Layers matter: the firewall stopped it, but even without it there was nothing to leak.
- Logging blocked traffic turns "my firewall works" from a guess into evidence.
How I used AI: Claude wrote the code that pulls the blocked requests from Cloudflare and helped me read them. I spotted the scan in my live lab, pulled the details and checked my defences held. The full, unedited notes are in my build log.