🇳🇱
homeshowdomain.nl
2026-10-14 22:02:29
(2 weeks ago)
Auto-ban: >3000 req/min op 2026-10-14
Web App Attack
SSH
Hacking
🇬🇧
openstrike.co.uk
2026-10-14 05:14:20
(2 weeks ago)
226 attacks on directory traversals, env grabbing URLs, config grabbing URLs (type 2), password/key grabbing URLs, PHP URLs, VC URLs, shell probes, env grabbing URLs (type 2):
GET /..%2f..%2f.env HTTP/1.1
GET /prisma/.env HTTP/1.1
GET /config/setting ...
show more
226 attacks on directory traversals, env grabbing URLs, config grabbing URLs (type 2), password/key grabbing URLs, PHP URLs, VC URLs, shell probes, env grabbing URLs (type 2):
GET /..%2f..%2f.env HTTP/1.1
GET /prisma/.env HTTP/1.1
GET /config/settings.local.yml HTTP/1.1
GET /id_ecdsa HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /.git/HEAD HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///proc/self/environ&environmentName=rsc HTTP/1.1
show less
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-14 03:31:19
(2 weeks ago)
[ti-hosboov] Web exploit scanning: 8 suspicious requests detected by fail2ban jail <name>. Example: 35.198.37.223 - - \[14/Oct/2026:05:31:16 +0200\] "GET /uploads../.env HTTP/1.1" 404 2101 "-" "CCBot/2.0 \(https://commoncrawl.org/faq/\)"
35.198.37.22 ...
show more
[ti-hosboov] Web exploit scanning: 8 suspicious requests detected by fail2ban jail <name>. Example: 35.198.37.223 - - \[14/Oct/2026:05:31:16 +0200\] "GET /uploads../.env HTTP/1.1" 404 2101 "-" "CCBot/2.0 \(https://commoncrawl.org/faq/\)"
35.198.37.223 - - \[14/Oct/2026:05:31:16 +0200\] "GET /api/.env/public/.env HTTP/1.1" 404 2101 "-" "Mozilla/5.0 \(compatible\; Amazonbot/0.1\; +https://developer.amazon.com/support/amazonbot\)"
35.198.37.223 - - \[14/Oct/2026:05:31:16 +0200\] "GET /.//.env HTTP/1.1" 404 2101 "-" "Mozilla/5.0 \(compatible\; GrokBot/1.0\; +https://x.ai/\)"
35.198.37.223 - - \[14/Oct/2026:05:31:16 +0200\] "GET //.env HTTP/1.1" 404 2101 "-" "Mozilla/5.0 \(Linux\; Android 6.0.1\; Nexus 5X Build/MMB29P\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Mobile Sa
...
show less
Bad Web Bot
Web App Attack
🇦🇺
nzhost.co.nz
2026-10-14 03:28:22
(2 weeks ago)
$f2bV_matches
Hacking
Brute-Force
🇨🇱
Fernando Soto
2026-10-14 03:05:35
(2 weeks ago)
WAF propio vps1 (CL): sensMASx195 score 32 en 1h. sondeo rutas sensibles.
Web App Attack
🇫🇷
guillaume illien
2026-10-14 02:27:16
(2 weeks ago)
35.198.37.223 - - [14/Oct/2026:02:27:15 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 166 "-" "-"
35.198.37.223 - - [14/Oct/2026:02:27:15 +0000] "GET /assets/worders_core/controllers/index-8764fa2d65d02f ...
show more
35.198.37.223 - - [14/Oct/2026:02:27:15 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 166 "-" "-"
35.198.37.223 - - [14/Oct/2026:02:27:15 +0000] "GET /assets/worders_core/controllers/index-8764fa2d65d02fb54a03755eab60a1d178051df66e23e533da88c6d6a024b3cb.js.map HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
35.198.37.223 - - [14/Oct/2026:02:27:15 +0000] "GET /assets/worders_core/controllers/application-48e8b4d3dfcce7f7f8225f64dfd4717ff1874643325602d9eed09ad17b95cb76.js.map HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
35.198.37.223 - - [14/Oct/2026:02:27:15 +0000] "GET /assets/worders_core/vendors/frappe-gantt.min-a5506a4af4f72a724ee1d72260f207ae954d54d9b7915a97f9ab19f6b289a67d.js.map HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHT
...
show less
Hacking
Brute-Force
Web App Attack
SSH
2026-10-14 02:11:54
(2 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇸🇬
Cloudkul Cloudkul
2026-10-14 01:54:26
(2 weeks ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
🇸🇪
vaia.cloud
2026-10-14 01:50:03
(2 weeks ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇳🇱
e.fierstra
2026-10-14 01:31:23
(2 weeks ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇦🇹
SchiWaGoA
2026-10-14 01:23:56
(2 weeks ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
2026-10-14 01:09:31
(2 weeks ago)
Aggressive web scan
Web App Attack
🇫🇷
guillaume illien
2026-10-13 23:59:06
(2 weeks ago)
35.198.37.223 - - [13/Oct/2026:23:59:05 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 166 "-" "-"
35.198.37.223 - - [13/Oct/2026:23:59:05 +0000] "GET /assets/worders_front/application-8dbe75a27fb7eaa5ae2 ...
show more
35.198.37.223 - - [13/Oct/2026:23:59:05 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 166 "-" "-"
35.198.37.223 - - [13/Oct/2026:23:59:05 +0000] "GET /assets/worders_front/application-8dbe75a27fb7eaa5ae243cc11ff6d626e1ce6f2a00364dd702f79842549b2625.js.map HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
35.198.37.223 - - [13/Oct/2026:23:59:06 +0000] "GET /assets/production/controllers/index-0b88f8bcfdada86e7ddcdce40441c46678a973b2e8e9226c9f21331b5e1a8757.js.map HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
35.198.37.223 - - [13/Oct/2026:23:59:06 +0000] "GET /assets/production/controllers/application-48e8b4d3dfcce7f7f8225f64dfd4717ff1874643325602d9eed09ad17b95cb76.js.map HTTP/1.1" 404 197 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Hacking
Brute-Force
Web App Attack
SSH
🇬🇧
Shadymint
2026-10-13 20:56:41
(2 weeks ago)
url probing from IP marked as abusive
Web App Attack
🇨🇭
4server
2026-10-13 19:59:15
(2 weeks ago)
[TueOct1321:59:12.3005702026][security2:error][pid336556:tid336644][client35.198.37.223:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:queryintrospectionquery\?\|__schema\\\\\\\\\?{\?\(\?:querytype\|types\?\)\)\?\\\\\\\\{\"atREQUE ...
show more
[TueOct1321:59:12.3005702026][security2:error][pid336556:tid336644][client35.198.37.223:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:queryintrospectionquery\?\|__schema\\\\\\\\\?{\?\(\?:querytype\|types\?\)\)\?\\\\\\\\{\"atREQUEST_BODY.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"234\"][id\"344378\"][rev\"2\"][msg\"Atomicorp.comWAFRules:GraphQLInjectionAttackattempt\"][data\"MatchedData:__schema{types{foundwithinREQUEST_BODY:{\\\\x22query\\\\x22:\\\\x22{__schema{types{namefields{nameargs{namedefaultvalue}}}}}\\\\x22}\"][severity\"CRITICAL\"][tag\"SQLi\"][hostname\"ticinosystem.ch\"][uri\"/graphql\"][unique_id\"as6NkLFRh91qRlCdrRJUDAAAAJQ\"]\,referer:https://ticinosystem.ch
show less
Hacking
Web App Attack
