Multiple web-apps attacks

Sec analyst here, recently noticed multiple attempts on our external facing apps including sub paths for directory traversal as


/adfs/ls/


/BACKUP.go.old


/.inc.old


/COPY.py.bak


/backup.go.old

/config\_2.old


/copy.php.bak


/config.json.bak


/config.script.bak


/.json.old


/COPY\_of\_1.bak


/COPY.php.old


/site.py.old


/.pl.old


user agent - python-requests/2.28.1

I'm digging into the attack vectors ,all GET methods, seems like more of a reconnaissance attempt from , well Hong Kong obv. Any advice on what to look for specifically? I do see a few status 200 OK and 302 Found which had …

adfs agent analyst apps attack attacks attack vectors backup copy cybersecurity directory directory traversal external inc. json old php python reconnaissance requests script sec web