Spring Boot Actuator Sensitive Endpoint Probe for 2026-09-13
Last Updated: 00:00 UTC
Spring Boot Actuator exposes management endpoints. heapdump returns a full JVM heap snapshot containing in-memory secrets. env returns all environment variables. gateway/routes is the RCE precursor for CVE-2022-22947 (Spring Cloud Gateway SPEL injection).
CVE References
MITRE ATT&CK
Tactic: Discovery (TA0007)
Technique: T1046 — Network Service Scanning
Observed URIs
Attackers by Country
| United States | 16 | 64.0% |
| Germany | 4 | 16.0% |
| Canada | 1 | 4.0% |
| Romania | 1 | 4.0% |
| Taiwan | 1 | 4.0% |
| Belgium | 1 | 4.0% |
| Japan | 1 | 4.0% |
IP Address : ASN : City/Provider
-
136.107.95.27 : AS396982 Google LLC : Washington
-
138.197.191.87 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
139.59.132.8 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
154.58.229.28 : AS400810 BreezeHost : New York
-
159.89.127.165 : AS14061 DigitalOcean, LLC : Toronto
-
178.128.207.138 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
2.57.122.202 : AS47890 Unmanaged Ltd : Romania
-
213.209.159.84 : AS208137 Feo Prest SRL : Taiwan
-
34.156.181.221 : AS396982 Google LLC : Brussels
-
34.158.241.61 : AS396982 Google LLC : The Dalles
-
34.186.136.22 : AS396982 Google LLC : Los Angeles
-
34.19.106.104 : AS396982 Google LLC : The Dalles
-
34.19.126.42 : AS396982 Google LLC : The Dalles
-
34.19.39.224 : AS396982 Google LLC : The Dalles
-
34.20.157.78 : AS396982 Google LLC : Los Angeles
-
34.20.163.72 : AS396982 Google LLC : Los Angeles
-
34.20.204.42 : AS396982 Google LLC : Los Angeles
-
34.20.210.172 : AS396982 Google LLC : Los Angeles
-
34.20.249.70 : AS396982 Google LLC : Los Angeles
-
34.24.160.49 : AS396982 Google LLC : North Charleston
-
34.85.102.235 : AS396982 Google LLC : Tokyo
-
35.227.117.203 : AS396982 Google LLC : North Charleston
-
35.252.155.236 : AS396982 Google LLC : The Dalles
-
45.45.237.65 : AS400529 Infraly, LLC : Chicago
-
46.101.111.185 : AS14061 DigitalOcean, LLC : Frankfurt am Main