🇺🇸
swordlegend228
2026-10-14 22:40:28
(2 weeks ago)
Sonde de scanner automatisee detectee sur un serveur web prive : /lib/terminal-xhr.php
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-14 22:23:04
(2 weeks ago)
Brute-Force
Web App Attack
🇧🇷
ICS Labs
2026-10-14 15:19:39
(2 weeks ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-10-14 UTC.
Brute-Force
Exploited Host
🇺🇸
brightenfield
2026-10-14 02:42:46
(2 weeks ago)
Web App Attack
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-14 02:42:03
(2 weeks ago)
2026/10/14 03:42:01 [error] 4060694#4060694: *3033376 access forbidden by rule, client: 35.240.215.25, server: centroestudostibetanos.org, request: "GET /api/orders/..%2f..%2f.env HTTP/1.1", host: "portal.centroestudostibetanos.org"
2026/10/14 03:42: ...
show more
2026/10/14 03:42:01 [error] 4060694#4060694: *3033376 access forbidden by rule, client: 35.240.215.25, server: centroestudostibetanos.org, request: "GET /api/orders/..%2f..%2f.env HTTP/1.1", host: "portal.centroestudostibetanos.org"
2026/10/14 03:42:01 [error] 4060693#4060693: *3033364 access forbidden by rule, client: 35.240.215.25, server: centroestudostibetanos.org, request: "GET /_nuxt/../.env HTTP/1.1", host: "portal.centroestudostibetanos.org"
2026/10/14 03:42:01 [error] 4060693#4060693: *3033367 access forbidden by rule, client: 35.240.215.25, server: centroestudostibetanos.org, request: "GET /api/data/..%2f..%2f.env HTTP/1.1", host: "portal.centroestudostibetanos.org"
show less
Brute-Force
Web App Attack
🇬🇧
andypiper
2026-10-14 01:00:11
(2 weeks ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇫🇷
WebServ
2026-10-14 00:16:52
(2 weeks ago)
Fail2Ban jail [nginx-noagent]: banned after 3 failed attempt(s). Non-browser User-Agent
Bad Web Bot
🇫🇷
SpaceHost-Server
2026-10-13 22:20:09
(2 weeks ago)
Brute-Force
Web App Attack
🇩🇪
macrob
2026-10-13 21:48:18
(2 weeks ago)
2026/10/13 21:48:16 [error] 3697906#3697906: *48944343 access forbidden by rule, client: 35.240.215.25, server: bonusnews.org, request: "GET /api/.env/public/.env HTTP/2.0", host: "bonusnews.org"
2026/10/13 21:48:16 [error] 3697908#3697908: *48944353 ...
show more
2026/10/13 21:48:16 [error] 3697906#3697906: *48944343 access forbidden by rule, client: 35.240.215.25, server: bonusnews.org, request: "GET /api/.env/public/.env HTTP/2.0", host: "bonusnews.org"
2026/10/13 21:48:16 [error] 3697908#3697908: *48944353 access forbidden by rule, client: 35.240.215.25, server: bonusnews.org, request: "GET //.env HTTP/2.0", host: "bonusnews.org"
2026/10/13 21:48:16 [error] 3697907#3697907: *48944306 access forbidden by rule, client: 35.240.215.25, server: bonusnews.org, request: "GET /static/..;/.env HTTP/2.0", host: "bonusnews.org"
...
show less
Web App Attack
2026-10-13 21:45:45
(2 weeks ago)
35.240.215.25 - - [13/Oct/2026:23:45:43 +0200] "GET / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"
35.240.215.25 - - [13/Oct/2026:23:45:44 +0200 ...
show more
35.240.215.25 - - [13/Oct/2026:23:45:43 +0200] "GET / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"
35.240.215.25 - - [13/Oct/2026:23:45:44 +0200] "GET /auth HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"
35.240.215.25 - - [13/Oct/2026:23:45:44 +0200] "GET /panel HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"
35.240.215.25 - - [13/Oct/2026:23:45:44 +0200] "GET /auth/login HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0"
35.240.215.25 - - [13/Oct/2026:23:45:44 +0200] "GET /eq3sm8fe87mlp3mb1fuc HTTP/1.1" 403 124 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; P
...
show less
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-10-13 21:40:11
(2 weeks ago)
2026-10-13 23:38:40 GET /media../.env [404] && 2026-10-13 23:38:40 GET /static/..;/..;/.env [404] && 2026-10-13 23:38:40 GET /static/..;/.env [404] && 217 more within 20 minutes
Web App Attack
2026-10-13 21:28:21
(2 weeks ago)
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
2026-10-13 19:47:02
(2 weeks ago)
Bot / scanning and/or hacking attempts: POST /exec-py HTTP/2.0, POST /api/functionRouter HTTP/2.0, POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e, POST /api/templates/preview HTTP/2.0, POST /webhook-test/ HTTP/2.0, POST /index.php?-d ...
show more
Bot / scanning and/or hacking attempts: POST /exec-py HTTP/2.0, POST /api/functionRouter HTTP/2.0, POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e, POST /api/templates/preview HTTP/2.0, POST /webhook-test/ HTTP/2.0, POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%, POST /form/ HTTP/2.0, POST /flowise/api/v1/node-load-method/customMCP HTTP/2.0, POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_, POST /api/v1/build_public_tmp/00000000-0000-0000-0000-000000000, POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_, POST /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend, POST /api/v1/node-load-method/customMCP HTTP/2.0, POST /cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_fil, POST /webhook/ HTTP/2.0, GET /static//.env HTTP/2.0
show less
Hacking
Web App Attack
🇺🇸
chrisj
2026-10-13 19:39:20
(2 weeks ago)
[Tue Oct 13 19:39:03.748211 2026] [proxy_fcgi:error] [pid 336274:tid 336296] [remote 35.240.215.25:36312] AH01071: Got error 'Primary script unknown'
[Tue Oct 13 19:39:18.182007 2026] [proxy_fcgi:error] [pid 336274:tid 336289] [remote 35.240.215.25:3 ...
show more
[Tue Oct 13 19:39:03.748211 2026] [proxy_fcgi:error] [pid 336274:tid 336296] [remote 35.240.215.25:36312] AH01071: Got error 'Primary script unknown'
[Tue Oct 13 19:39:18.182007 2026] [proxy_fcgi:error] [pid 336274:tid 336289] [remote 35.240.215.25:36312] AH01071: Got error 'Primary script unknown'
[Tue Oct 13 19:39:19.661398 2026] [proxy_fcgi:error] [pid 336274:tid 336287] [remote 35.240.215.25:36312] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
🇩🇪
macrob
2026-10-13 17:21:04
(2 weeks ago)
2026/10/13 17:21:02 [error] 3406592#3406592: *48204500 access forbidden by rule, client: 35.240.215.25, server: 100fs.org, request: "GET /.vite/manifest.json HTTP/1.1", host: "100fs.org"
2026/10/13 17:21:02 [error] 3406590#3406590: *48204504 access f ...
show more
2026/10/13 17:21:02 [error] 3406592#3406592: *48204500 access forbidden by rule, client: 35.240.215.25, server: 100fs.org, request: "GET /.vite/manifest.json HTTP/1.1", host: "100fs.org"
2026/10/13 17:21:02 [error] 3406590#3406590: *48204504 access forbidden by rule, client: 35.240.215.25, server: 100fs.org, request: "GET /dist/.vite/manifest.json HTTP/1.1", host: "100fs.org"
2026/10/13 17:21:02 [error] 3406589#3406589: *48204457 access forbidden by rule, client: 35.240.215.25, server: 100fs.org, request: "GET /dist../.env HTTP/1.1", host: "100fs.org"
...
show less
Web App Attack
