🇫🇷
SpaceHost-Server
2026-10-09 22:23:13
(3 weeks ago)
Brute-Force
Web App Attack
🇺🇸
EvilTurkey
2026-10-09 12:47:26
(3 weeks ago)
Web app attack against financial institution website.
Web App Attack
Hacking
🇺🇸
swordlegend228
2026-10-09 09:14:00
(3 weeks ago)
sonde /cache/original/../.env
Bad Web Bot
Web App Attack
🇦🇲
arm osint
2026-10-09 06:13:58
(3 weeks ago)
Automated web vulnerability scanning: 96 HTTP 4xx probes for sensitive paths (/api/designer/v1/file-content, /api/templates/preview, /read-document, /%2eenv). Detected by Wazuh HIDS rule 31151 on a self-hosted web server.
Web App Attack
Brute-Force
🇩🇪
macrob
2026-10-09 05:15:11
(3 weeks ago)
2026/10/09 05:15:09 [error] 1310591#1310591: *32381130 access forbidden by rule, client: 34.85.50.125, server: fn.binixo.es, request: "GET /.vite/manifest.json HTTP/2.0", host: "app.wynspire.org"
2026/10/09 05:15:09 [error] 1310592#1310592: *32381132 ...
show more
2026/10/09 05:15:09 [error] 1310591#1310591: *32381130 access forbidden by rule, client: 34.85.50.125, server: fn.binixo.es, request: "GET /.vite/manifest.json HTTP/2.0", host: "app.wynspire.org"
2026/10/09 05:15:09 [error] 1310592#1310592: *32381132 access forbidden by rule, client: 34.85.50.125, server: fn.binixo.es, request: "GET /dist/.vite/manifest.json HTTP/2.0", host: "app.wynspire.org"
2026/10/09 05:15:09 [error] 1310592#1310592: *32381140 access forbidden by rule, client: 34.85.50.125, server: fn.binixo.es, request: "GET /.htpasswd HTTP/2.0", host: "app.wynspire.org"
...
show less
Web App Attack
2026-10-09 04:41:38
(3 weeks ago)
DNS Compromise
DDoS Attack
2026-10-09 03:00:07
(3 weeks ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇱🇹
NotACaptcha
2026-10-09 02:37:54
(3 weeks ago)
webserver:443 [09/Oct/2026] "GET /.next/.env HTTP/1.1" 302 447 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
webserver:443 [09/Oct/2026] "GET /docker/.env HTTP/1.1" 302 449 "-" "Mozilla/5.0 (compatible ...
show more
webserver:443 [09/Oct/2026] "GET /.next/.env HTTP/1.1" 302 447 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
webserver:443 [09/Oct/2026] "GET /docker/.env HTTP/1.1" 302 449 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
webserver:443 [09/Oct/2026] "GET /web/.env HTTP/1.1" 302 5777 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
webserver:443 [09/Oct/2026] "GET /frontend/.env HTTP/1.1" 302 453 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
webserver:443 [09/Oct/2026] "GET /server/.env HTTP/1.1" 302 449 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
webserver:443 [09/Oct/2026] "GET /setcookie__ro.html HTTP/1.1" 302 5797 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
webserver:443 [09/Oct/2026] "POST / HTTP/1.1" 302 5761...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 02:27:43
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.85.50.125 (125.50.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:27:40.306652 2026] [security2:error] [pid 15782:tid 15 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.50.125 (125.50.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:27:40.306652 2026] [security2:error] [pid 15782:tid 15782] [client 34.85.50.125:42014] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "_dc-mx.f6ca26bdca12.hcoahawaii.org"] [uri "/.htpasswd"] [unique_id "ashRHOaGFbmG5LMmnmbxKgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Mundo Bueno
2026-10-09 01:46:54
(3 weeks ago)
[ISILIA Protection v2.3] Tentative d'accès: /@fs/home/ubuntu/.aws/credentials [RATE LIMITED - 1800s quarantine] | Pays: JP | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic
Hacking
Web App Attack
🇺🇸
JonathanYoung2161
2026-10-09 01:45:33
(3 weeks ago)
trekgalactic.org 34.85.50.125 - - [08/Oct/2026:20:45:31 -0500] "GET /userfiles?path=../../.env HTTP/2.0" 404 3199 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
trekgalactic.org 34.85.50.125 - - [08/Oct/2026:20:45:31 -0500] " ...
show more
trekgalactic.org 34.85.50.125 - - [08/Oct/2026:20:45:31 -0500] "GET /userfiles?path=../../.env HTTP/2.0" 404 3199 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
trekgalactic.org 34.85.50.125 - - [08/Oct/2026:20:45:31 -0500] "GET /userfiles?path=../../../.env HTTP/2.0" 404 3199 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
trekgalactic.org 34.85.50.125 - - [08/Oct/2026:20:45:31 -0500] "GET /api/system/fileView?file=/app/.env HTTP/2.0" 404 3199 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 01:42:49
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.85.50.125 (125.50.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:42:44.946249 2026] [security2:error] [pid 25814:tid 25 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.50.125 (125.50.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:42:44.946249 2026] [security2:error] [pid 25814:tid 25814] [client 34.85.50.125:33666] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tlo-afghanistan.org"] [uri "/.env.example"] [unique_id "ashGlIhjc9mCKDfFxpjCiwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-09 01:05:43
(3 weeks ago)
2026/10/09 02:05:30 [error] 4060693#4060693: *1367035 access forbidden by rule, client: 34.85.50.125, server: simetria.org, request: "GET /cache/original/%2e%2e/.env HTTP/2.0", host: "simetria.org"
2026/10/09 02:05:32 [error] 4060693#4060693: *136705 ...
show more
2026/10/09 02:05:30 [error] 4060693#4060693: *1367035 access forbidden by rule, client: 34.85.50.125, server: simetria.org, request: "GET /cache/original/%2e%2e/.env HTTP/2.0", host: "simetria.org"
2026/10/09 02:05:32 [error] 4060693#4060693: *1367058 access forbidden by rule, client: 34.85.50.125, server: simetria.org, request: "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/2.0", host: "simetria.org"
2026/10/09 02:05:41 [error] 4060693#4060693: *1367058 access forbidden by rule, client: 34.85.50.125, server: simetria.org, request: "GET /.env HTTP/2.0", host: "simetria.org"
show less
Brute-Force
Web App Attack
🇩🇪
Blexyel
2026-10-09 00:34:21
(3 weeks ago)
34.85.50.125 - - [09/Oct/2026:02:34:21 +0200] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 153 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https:/ ...
show more
34.85.50.125 - - [09/Oct/2026:02:34:21 +0200] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 153 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" "pingusmc.org"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 00:01:56
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.85.50.125 (125.50.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:01:51.290513 2026] [security2:error] [pid 14185:tid 14 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.50.125 (125.50.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:01:51.290513 2026] [security2:error] [pid 14185:tid 14185] [client 34.85.50.125:36328] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mroxygen.org"] [uri "/.env"] [unique_id "asgu78gsHqYG_G_7T-kOJAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
