Scanning Webserver with /$(pwd)/ as a Starting Path, (Sun, Jan 25th)

ISC sensors observed a small campaign of reconnaissance scans in mid-January 2026 from IPs 185.177.72.52 and 185.177.72.23 probing for URLs containing the literal $(pwd) string and exposed configuration files (.env*, terraform.tfstate, docker-compose.yml, netlify.toml). The report includes a Kibana ES|QL query to identify matching events and notes limited probe volumes, along with references to visualized relationships among probed URLs.