🇺🇸
snappic
2026-10-09 21:23:02
(3 weeks ago)
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)]
Bad Web Bot
Web App Attack
🇫🇮
KTSTechnology
2026-10-09 17:28:09
(3 weeks ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇮🇩
hiiruki
2026-10-09 16:56:34
(3 weeks ago)
Cloudflare WAF: Block by managed rules. Automated web scanner probing for sensitive files (.env/.git); admin panels/known CVE endpoints; path traversal: 53 requests, 11 distinct probe paths (2026-10-09 13:59:33 to 16:56:34 UTC), e.g. /actuator, /api/ ...
show more
Cloudflare WAF: Block by managed rules. Automated web scanner probing for sensitive files (.env/.git); admin panels/known CVE endpoints; path traversal: 53 requests, 11 distinct probe paths (2026-10-09 13:59:33 to 16:56:34 UTC), e.g. /actuator, /api/w/starter/jobs_u/get_log_file/../../../../pro, /api/w/admins/jobs_u/get_log_file/../../../../proc, /.ssh/id_ed25519, /actuator/mappings, /.env.old. 6 POST requests to login/signup/admin endpoints (e.g. /api/v1/node-load-method/customMCP, /api/auth, /dashboard). Request details: GET/POST HTTP/2; User agent: 11 rotating user agents (crawler-style e.g. CCBot/2.0; Amazonbot/0.1; Bytespider; DeepSeekBot/1.0); Verified bot category: None; ASN: 396982 - Google LLC; Country: TW.
show less
Hacking
Brute-Force
Web App Attack
🇨🇭
ca
2026-10-09 16:42:38
(3 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
rh24
2026-10-09 15:47:05
(3 weeks ago)
(badbots) Bad bot user-agent [redacted] from 104.199.212.254 (TW/Taiwan/254.212.199.104.bc.googleusercontent.com)
Hacking
🇩🇪
jack252
2026-10-09 15:35:11
(3 weeks ago)
2026/10/09 17:35:10 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php-cgi.exe" failed (2: No such file or directory), client: 104.199.212.254, server: _, request: "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file ...
show more
2026/10/09 17:35:10 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php-cgi.exe" failed (2: No such file or directory), client: 104.199.212.254, server: _, request: "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.nood.li"
2026/10/09 17:35:10 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php" failed (2: No such file or directory), client: 104.199.212.254, server: _, request: "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.nood.li"
2026/10/09 17:35:11 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php-cgi" failed (2: No such file or directory), client: 104.199.212.254, server: _, request: "POST /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.nood.li"
...
show less
Brute-Force
Bad Web Bot
🇬🇧
KTSTechnology
2026-10-09 15:23:44
(3 weeks ago)
Repeated connection attempts to firewalled ports, detected by our ISP firewall Interconnect WL
Port Scan
🇩🇪
club77
2026-10-09 15:07:36
(3 weeks ago)
104.199.212.254 - - [09/Oct/2026:23:07:33 +0800] "GET /lib/terminal-xhr.php HTTP/2.0" 404 101504 "https://vicinity.life/lib/terminal-xhr.php" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
104.199.212.254 - - [09/Oct/2026:23:07:3 ...
show more
104.199.212.254 - - [09/Oct/2026:23:07:33 +0800] "GET /lib/terminal-xhr.php HTTP/2.0" 404 101504 "https://vicinity.life/lib/terminal-xhr.php" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
104.199.212.254 - - [09/Oct/2026:23:07:34 +0800] "GET /icecoder/lib/terminal-xhr.php HTTP/2.0" 404 101553 "https://vicinity.life/icecoder/lib/terminal-xhr.php" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
104.199.212.254 - - [09/Oct/2026:23:07:36 +0800] "GET /.env?raw?? HTTP/2.0" 404 101305 "https://vicinity.life/@fs/../.env?raw??" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
...
show less
Web App Attack
🇦🇹
penguin-solutions.at
2026-10-09 14:53:02
(3 weeks ago)
Excessive 403/404 errors
...
Brute-Force
Web App Attack
🇩🇪
Laplus
2026-10-09 14:43:03
(3 weeks ago)
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /media../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /static../.env HTTP/1.1" 302 145 "-" "Mozilla/5 ...
show more
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /media../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /static../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /files../.env HTTP/1.1" 302 145 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /images../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /assets../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /uploads../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/c
...
show less
Hacking
Web App Attack
🇨🇭
zynex
2026-10-09 13:43:06
(3 weeks ago)
URL Probing: /api/.env
Web App Attack
🇬🇧
consul.to
2026-10-09 13:24:15
(3 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
ELYAZ
2026-09-20 15:26:55
(1 month ago)
(y3) Failed access -byebye- from 104.199.212.254 (TW/Taiwan/254.212.199.104.bc.googleusercontent.com): (CF_ENABLE)
Hacking
🇺🇸
TPI-Abuse
2026-09-20 14:31:00
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.199.212.254 (254.212.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:30:52.284243 2026] [security2:error] [pid 1398:t ...
show more
(mod_security) mod_security (id:210492) triggered by 104.199.212.254 (254.212.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:30:52.284243 2026] [security2:error] [pid 1398:tid 1398] [client 104.199.212.254:36848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "diamenty.info"] [uri "/api/.env"] [unique_id "aq_uHKu0lG74MqitFHng7AAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
grassau.com
2026-09-20 14:28:34
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 104.199.212.254 (TW/Taiwan/Taipei City/Taipei/254.212.199.104.bc.googleusercontent.com)
Bad Web Bot
