http://3cbzkrvakrpetjjppdwzbzqrlkmzatjs7jbyazap5gwutj32gcltjpqd.onion
Maybe some
framework does bad tilde expansion, but at least bash will not expand ~ inside
a path, it seems—that path is passed as-is to an invoked command ( strace confirms it). What’s surprising here is that these are usually plain dumb scanners, from the
same IP address, no concern on throttling, no attempt to hide, just 2 minutes of
brute-forcing a random list of known “treasures”, then moving on.