|
🇫🇷
SpaceHost-Server
|
|
|
Brute-Force
Web App Attack
|
|
🇬🇧
openstrike.co.uk
|
|
226 attacks on config grabbing URLs (type 2), env grabbing URLs, directory traversals, shell probes, env grabbing URLs (type 2), password/key grabbing URLs, VC URLs, PHP URLs:
GET /config/database.json HTTP/1.1
GET /prisma/.env HTTP/1.1
GET /..%2f..% ...
show more
226 attacks on config grabbing URLs (type 2), env grabbing URLs, directory traversals, shell probes, env grabbing URLs (type 2), password/key grabbing URLs, VC URLs, PHP URLs:
GET /config/database.json HTTP/1.1
GET /prisma/.env HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
GET /.git/HEAD HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
|
Hacking
Web App Attack
|
|
🇩🇪
Philister11
|
|
CrowdSec: crowdsecurity/http-path-traversal-probing (US/AS396982)
|
Web App Attack
Hacking
|
|
🇫🇷
SpaceHost-Server
|
|
|
Brute-Force
Web App Attack
|
|
🇩🇪
Gwyneth Llewelyn
|
|
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.187, server: api.betatechnologies.info, request: "GET /img../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/12 18:45:54 [error] 4060693#4060 ...
show more
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.187, server: api.betatechnologies.info, request: "GET /img../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.187, server: api.betatechnologies.info, request: "GET /build../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.187, server: api.betatechnologies.info, request: "GET /media../.env HTTP/2.0", host: "api.betatechnologies.info"
show less
|
Brute-Force
Web App Attack
|
|
🇩🇪
XICTRON
|
|
ModSecurity rule violation detected by Fail2Ban
|
Web App Attack
|
|
Anonymous
|
|
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 136.67.160.187 - - [12/Oct/2026:18:49:31 +0200] "G ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 136.67.160.187 - - [12/Oct/2026:18:49:31 +0200] "GET /static//.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
136.67.160.187 - - [12/Oct/2026:18:49:31 +0200] "GET /css../.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
136.67.160.187 - - [12/Oct/2026:18:49:31 +0200] "GET /public../.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
show less
|
Port Scan
|
|
🇳🇱
Site.eu
|
|
Excessive multi-domain requests
|
Brute-Force
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:34:41.384832 2026] [security2:error] [pid 30571:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:34:41.384832 2026] [security2:error] [pid 30571:tid 30571] [client 136.67.160.187:57122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xrp589.info"] [uri "/media../.env"] [unique_id "as0MIccnhKqKGdNBr6VnxQAAAAc"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
Nevermind
|
|
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /serviceAccountKey.json HTTP/1.1" 404 5695 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /document.php?modulepart=systemtools ...
show more
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /serviceAccountKey.json HTTP/1.1" 404 5695 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1" 404 5483 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /docker-compose.yml HTTP/1.1" 404 5695 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.67.160.187 - - [12/Oct/2026:18:17:09 +0200] "GET /docker-compose.yaml HTTP/1.1" 404 5695 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
...
show less
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:16:03.268552 2026] [security2:error] [pid 8919:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:16:03.268552 2026] [security2:error] [pid 8919:tid 8919] [client 136.67.160.187:42218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "solarfarms.info"] [uri "/uploads../.env"] [unique_id "as0Hw9uVW5YA4roMDc_vOQAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇳🇱
middelkoopcc
|
|
2026-10-12 18:11:45 AH10244: invalid URI path (/%2e%2e/.env) && 2026-10-12 18:11:45 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ) && 2026-10-12 18:11:46 AH10244: invalid URI path (/appearance/../../proc/self/envir ...
show more
2026-10-12 18:11:45 AH10244: invalid URI path (/%2e%2e/.env) && 2026-10-12 18:11:45 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ) && 2026-10-12 18:11:46 AH10244: invalid URI path (/appearance/../../proc/self/environ) && 231 more within 20 minutes
show less
|
Web App Attack
|
|
🇺🇸
n2nguyenn2nguyen
|
|
Blocked by YFC Security on https://1904.brixzly.com — type: directory_scan_attempts
|
Web App Attack
|
|
Anonymous
|
|
[Mon Oct 12 17:03:49.992618 2026] [access_compat:error] [pid 3615746:tid 3615746] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.dockerenv, referer: https://loretlargent.info/.dockerenv ...
show more
[Mon Oct 12 17:03:49.992618 2026] [access_compat:error] [pid 3615746:tid 3615746] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.dockerenv, referer: https://loretlargent.info/.dockerenv
[Mon Oct 12 17:03:50.368548 2026] [access_compat:error] [pid 3615746:tid 3615746] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/server.key, referer: https://loretlargent.info/server.key
[Mon Oct 12 17:03:50.375829 2026] [access_compat:error] [pid 3615695:tid 3615695] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/...., referer: https://loretlargent.info/....//....//....//..../proc/self/environ
[Mon Oct 12 17:03:50.426272 2026] [access_compat:error] [pid 3616488:tid 3616488] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/key.pem, referer: https://lore
...
show less
|
Web Spam
Web App Attack
|
|
🇩🇪
LRob
|
|
Crawler ignoring refusals | ua: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/), Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 1 ...
show more
Crawler ignoring refusals | ua: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/), Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/ (+11 more) | path: /6hfzjzh6m7f1cg11grrd, /manifest.json, /asset-manifest.json (+17 more)
show less
|
Bad Web Bot
|
