2026-10-27 04:32:36
(2 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇳🇱
Alt255
2026-10-26 21:23:21
(2 days ago)
[ti-tinov] Web exploit scanning: 17 suspicious requests detected by fail2ban jail <name>. Example: 34.143.183.179 - - [24/Oct/2026:22:20:41 +0200] "GET /.env.development?raw HTTP/1.1" 404 2121 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https: ...
show more
[ti-tinov] Web exploit scanning: 17 suspicious requests detected by fail2ban jail <name>. Example: 34.143.183.179 - - [24/Oct/2026:22:20:41 +0200] "GET /.env.development?raw HTTP/1.1" 404 2121 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.143.183.179 - - [24/Oct/2026:22:20:41 +0200] "GET /.env.development?import&raw HTTP/1.1" 404 7394 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
34.143.183.179 - - [24/Oct/2026:22:20:41 +0200] "GET /.env.local?import&raw HTTP/1.1" 404 7394 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.143.183.179 - - [24/Oct/2026:22:20:41 +0200] "GET /.env?.svg?.wasm?init HTTP/1.1" 404 7394 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0
...
show less
Bad Web Bot
Web App Attack
🇩🇪
sternwart
2026-10-26 13:36:16
(2 days ago)
Automatisch erkannt: Zugriff auf /@fs/src/.env?raw?? (absofort.ch)
Web App Attack
Bad Web Bot
🇩🇪
mbch
2026-10-26 13:01:28
(2 days ago)
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-10-26T13:01:28.284000+00:00 to 2026-10-26T13:01:29.681000+00:00: 10 distinct paths in 1.397s, denied HTTP 404. Trusted client-IP processing; forw ...
show more
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-10-26T13:01:28.284000+00:00 to 2026-10-26T13:01:29.681000+00:00: 10 distinct paths in 1.397s, denied HTTP 404. Trusted client-IP processing; forwarding headers accepted only from official configured Cloudflare networks. No successful compromise established. Examples: /reset-password, /dist/.vite/manifest.json, /admin/login, /portal, /dist/manifest.json, /build/manifest.json, /forgot-password, /users/login, /backoffice, /panel.
show less
Web App Attack
🇧🇪
voormedia
2026-10-26 12:39:07
(2 days ago)
Accessed trap at '/secrets.yml'
Web App Attack
🇨🇦
CentiDevOps
2026-10-26 07:40:20
(2 days ago)
Web app scan: 41 requests in 0 s across 2 domains (301/444). Paths: /.env.backup, /.env.bak, /.env.example (+4 more). Sample: 2026-10-26T07:40:20Z "GET /.env.production" 301
Hacking
Web App Attack
🇺🇸
antlac1
2026-10-26 05:34:39
(2 days ago)
CrowdSec detected malicious behaviour (scenario: crowdsecurity/http-sensitive-files)
Web App Attack
🇺🇸
antlac1
2026-10-26 00:48:48
(3 days ago)
CrowdSec detected malicious behaviour (scenario: crowdsecurity/http-crawl-non_statics)
Bad Web Bot
🇪🇸
robotstxt
2026-10-25 23:31:11
(3 days ago)
34.143.183.179 - - [25/Oct/2026:23:30:43 +0000] "GET /robots.txt HTTP/2.0" 403 127 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" "-" edge="34.143.183.179"
34.143.183.179 - - [25/ ...
show more
34.143.183.179 - - [25/Oct/2026:23:30:43 +0000] "GET /robots.txt HTTP/2.0" 403 127 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" "-" edge="34.143.183.179"
34.143.183.179 - - [25/Oct/2026:23:30:44 +0000] "GET /sitemap.xml HTTP/2.0" 403 20 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )" "-" edge="34.143.183.179"
34.143.183.179 - - [25/Oct/2026:23:30:45 +0000] "GET /sitemap_index.xml HTTP/2.0" 403 16242 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)" "-" edge="34.143.183.179"
34.143.183.179 - - [25/Oct/2026:23:30:47 +0000] "GET /dist/.vite/manifest.json HTTP/2.0" 403 16090 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0" "-" edge="34.143.183.179"
34.143.183.179 - - [25/Oct/2026:23:30:47 +0000] "GET /ngsw.json HTTP/2.0" 403 16090 "-" "Mozilla/5.0 (Linux;
...
show less
Web App Attack
🇺🇸
kbeezie
2026-10-25 22:47:41
(3 days ago)
34.143.183.179 - - [25/Oct/2026:18:47:35 -0400] "GET /netlify.toml HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.143.183.179 - - [25/Oct/2026:18:47:35 -0400] "GET /vercel.json HTTP/1.1" ...
show more
34.143.183.179 - - [25/Oct/2026:18:47:35 -0400] "GET /netlify.toml HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.143.183.179 - - [25/Oct/2026:18:47:35 -0400] "GET /vercel.json HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
34.143.183.179 - - [25/Oct/2026:18:47:39 -0400] "GET /%2Fapi/config HTTP/1.1" 429 162 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.143.183.179 - - [25/Oct/2026:18:47:39 -0400] "GET /clients/ HTTP/1.1" 429 564 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
34.143.183.179 - - [25/Oct/2026:18:47:41 -0400] "GET /ssl/localhost.key HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
show less
Bad Web Bot
Web App Attack
🇺🇸
antlac1
2026-10-25 21:52:46
(3 days ago)
CrowdSec detected malicious behaviour (scenario: LePresidente/http-generic-403-bf)
Web App Attack
🇳🇱
Site.eu
2026-10-25 21:01:25
(3 days ago)
Excessive multi-domain requests
Brute-Force
2026-10-25 20:08:17
(3 days ago)
SIEM ALERT AUTO REPORT
Email Spam
🇫🇷
masterguru
2026-10-25 18:52:39
(3 days ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .d ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-193)
show less
Hacking
🇸🇬
Cloudkul Cloudkul
2026-10-25 03:49:07
(4 days ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
