🇳🇱
Site.eu
2026-10-12 01:43:13
(3 weeks ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
openstrike.co.uk
2026-10-10 05:13:51
(3 weeks ago)
923 attacks on env grabbing URLs, PHP URLs, shell probes, config grabbing URLs (type 2), env grabbing URLs (type 2), password/key grabbing URLs, directory traversals, VC URLs:
GET //.env HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prep ...
show more
923 attacks on env grabbing URLs, PHP URLs, shell probes, config grabbing URLs (type 2), env grabbing URLs (type 2), password/key grabbing URLs, directory traversals, VC URLs:
GET //.env HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /secrets.yml HTTP/1.1
GET /public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /.git/config HTTP/1.1
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-09 21:59:58
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-08.
Web App Attack
SSH
Hacking
🇬🇧
openstrike.co.uk
2026-10-09 05:14:44
(3 weeks ago)
1113 attacks on password/key grabbing URLs, env grabbing URLs (type 2), shell probes, env grabbing URLs, config grabbing URLs (type 2), VC URLs, directory traversals, PHP URLs:
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&enviro ...
show more
1113 attacks on password/key grabbing URLs, env grabbing URLs (type 2), shell probes, env grabbing URLs, config grabbing URLs (type 2), VC URLs, directory traversals, PHP URLs:
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=rsc HTTP/1.1
GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /%2e%2e/.env HTTP/1.1
GET /app-config.json HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
WellSpring
2026-10-09 03:33:52
(3 weeks ago)
good bot honeypot on tableoftheround.org/@fs/.env — WellSpr.ing/NetSentinel civic-AI security layer
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-09 03:33:38
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.90.23.235 (235.23.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 23:33:34.618122 2026] [security2:error] [pid 25997:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 136.90.23.235 (235.23.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 23:33:34.618122 2026] [security2:error] [pid 25997:tid 25997] [client 136.90.23.235:45006] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tableman2.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tableman2.com"] [uri "/z9x8c7v6b5-debug-trigger-tableman2.com"] [unique_id "ashgjvWy_2aFDchzFogSBgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-09 02:54:45
(3 weeks ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-09 02:05:17
(3 weeks ago)
Too many Status 40X (13)
Brute-Force
Web App Attack
🇨🇭
backslash
2026-10-09 00:07:10
(3 weeks ago)
block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-08 23:53:49
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.90.23.235 (235.23.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:53:42.457206 2026] [security2:error] [pid 17472:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 136.90.23.235 (235.23.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:53:42.457206 2026] [security2:error] [pid 17472:tid 17472] [client 136.90.23.235:41048] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||szeliga.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "szeliga.com"] [uri "/z9x8c7v6b5-debug-trigger-szeliga.com"] [unique_id "asgtBh0r0EIXkHqEovih9wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-08 23:17:49
(3 weeks ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
SYSMarshal
2026-10-08 23:08:52
(3 weeks ago)
SYSMarshal: Exploit Attempt — 131 malicious of 401 HTTP requests to an IIS web server; probing for admin and config files, path traversal, probing for backup files; e.g. /.env /dashboard/.env; peak 401 requests/min; seen 2026-10-08 23:08–23:08 UTC.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 23:06:27
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.90.23.235 (235.23.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:06:23.856901 2026] [security2:error] [pid 21645:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 136.90.23.235 (235.23.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:06:23.856901 2026] [security2:error] [pid 21645:tid 21645] [client 136.90.23.235:52832] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||syscoxlegends.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "syscoxlegends.com"] [uri "/z9x8c7v6b5-debug-trigger-syscoxlegends.com"] [unique_id "asgh73jF3qD8XOJkP9uMLgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Starburst SysOp Team
2026-10-08 23:04:50
(3 weeks ago)
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX: ...
show more
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-mnz6-7)
show less
Bad Web Bot
🇧🇷
radardatelecom
2026-10-08 22:27:07
(3 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
