🇧🇷
ICS Labs
2026-10-20 16:51:12
(1 day ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-20 UTC.
Brute-Force
2026-10-20 11:23:00
(1 day ago)
Excessive crawling/scraping. Vulnerable file probing.
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-10-20 07:50:16
(1 day ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 07:47:23
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.107.52.242 (242.52.107.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.52.242 (242.52.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 03:47:18.885341 2026] [security2:error] [pid 27072:tid 27072] [client 136.107.52.242:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "portfoliolighting.net"] [uri "/_image"] [unique_id "atcchobh9LRtewPYTzsUGAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-10-20 07:46:39
(1 day ago)
136.107.52.242 - - [20/Oct/2026:09:46:35 +0200] "GET /services/.env HTTP/2.0" 404 289 "-" "Mozilla/5 ...
show more
136.107.52.242 - - [20/Oct/2026:09:46:35 +0200] "GET /services/.env HTTP/2.0" 404 289 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
136.107.52.242 - - [20/Oct/2026:09:46:35 +0200] "GET /packages/.env HTTP/2.0" 404 289 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.107.52.242 - - [20/Oct/2026:09:46:35 +0200] "GET /workspace/.env HTTP/2.0" 404 289 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
136.107.52.242 - - [20/Oct/2026:09:46:35 +0200] "GET /api/v1/.env HTTP/2.0" 403 293 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email])"
136.107.52.242 - - [20/Oct/2026:09:46:35 +0200] "GET /project/.env HTTP/2.0" 404 289 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.107.52.242 - - [20/Oct/2026:09:46:36 +0200] "GET /infra/.env HTTP/2.0" 403 316 "-" "Mozilla/5.0 (compatible
show less
Web App Attack
Hacking
🇳🇱
Site.eu
2026-10-20 07:34:17
(1 day ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
updown.io
2026-10-20 07:11:05
(1 day ago)
{"level":"info","ts":1792480263.781549,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1792480263.781549,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.107.52.242","remote_port":"36856","client_ip":"136.107.52.242","proto":"HTTP/2.0","method":"GET","host":"status.poedit.net","uri":"/static/manifest.json","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Priority":["u=0, i"],"Sec-Fetch-Site":["none"],"X-Nextjs-Data":["1"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Upgrade-Insecure-Requests":["1"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""],"Sec-Fetch-Mode":["navigate"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-User":["?1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK
...
show less
DDoS Attack
Web App Attack
🇫🇷
masterguru
2026-10-20 06:47:33
(1 day ago)
BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:User-Agent. (1100000 ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:User-Agent. (1100000-195)
show less
Bad Web Bot
🇩🇪
Jochen Pretli
2026-10-20 05:31:32
(1 day ago)
connection to honeypot
Email Spam
Port Scan
🇩🇪
Bedios GmbH
2026-10-20 05:14:19
(1 day ago)
Scanning for exposed credentials and private keys
Hacking
🇩🇪
XICTRON
2026-10-20 05:10:07
(1 day ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇫🇷
dynamix
2026-10-20 05:08:29
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇸
snappic
2026-10-20 00:39:18
(1 day ago)
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 (c ...
show more
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)]
show less
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-10-19 22:03:33
(1 day ago)
136.107.52.242 - - [19/Oct/2026:22:03:31 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.en ...
show more
136.107.52.242 - - [19/Oct/2026:22:03:31 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.107.52.242"
136.107.52.242 - - [19/Oct/2026:22:03:31 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.107.52.242"
136.107.52.242 - - [19/Oct/2026:22:03:31 +0000] "GET /resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.107.52.242"
136.107.52.242 - - [19/Oct/2026:22:03:31 +0000] "GET /resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.107.52.242"
136.107.52.242 - - [19/Oct/2026:22:03:31 +0000] "GET /..%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.107.52.242"
...
show less
Web Spam
Web App Attack
🇺🇸
mad-abuseip
2026-10-19 21:42:27
(1 day ago)
SCORE:99 REASON:suspicious-score:123 | "POST /api/ HTTP/1.1" SCORE:99 REASON:suspicious-score:123 - ...
show more
SCORE:99 REASON:suspicious-score:123 | "POST /api/ HTTP/1.1" SCORE:99 REASON:suspicious-score:123 - "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
show less
Web App Attack
