๐ง๐ท
ICS Labs
2026-10-21 14:39:38
(3 days ago)
ICS Labs threat intelligence (ICS Feeds): Hacking. Last observed 2026-10-21 UTC.
Hacking
๐ฉ๐ช
updown.io
2026-10-21 11:13:31
(4 days ago)
{"level":"info","ts":1792581210.336477,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1792581210.336477,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.108.244.132","remote_port":"33500","client_ip":"136.108.244.132","proto":"HTTP/2.0","method":"GET","host":"status.acso.org.au","uri":"/asset-manifest.json","headers":{"X-Nextjs-Data":["1"],"Priority":["u=0, i"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Ch-Ua-Mobile":["?0"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Microsoft Edge\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Fetch-Site":["none"],"Sec-Fetch-User":["?1"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept-Language":["en-US,en;q=0.9"],"Accept":["text/html,application/xhtml+xml,
...
show less
DDoS Attack
Web App Attack
๐บ๐ธ
Epimetheus
2026-10-21 10:37:01
(4 days ago)
Zombie network / Bot scanner detected:
[POST] /lib/terminal-xhr.php
[GET] /__vite_rsc_findSourceMap ...
show more
Zombie network / Bot scanner detected:
[POST] /lib/terminal-xhr.php
[GET] /__vite_rsc_findSourceMapURL
[GET] /.env.production.local
[GET] /firebase-adminsdk.json
[GET] /@fs/../.env
[GET] /terraform.tfstate
[GET] /@fs/app/.env.production
[GET] /@fs/.env
[GET] /vercel.json
[GET] /.cache/huggingface/token
[GET] /.cargo/credentials.toml
[GET] /__vite_rsc_findSourceMapURL
[GET] /.config/gcloud/application_default_credentials.json
[GET] /.env.development
[GET] /secrets.env
[GET] /@fs/..%252f..%252f..%252f..%252f..%252froot/.env
[GET] /.dbeaver/credentials-config.json
[GET] /.dev.vars
[GET] /@fs/app/.env
[GET] /gcp-credentials.json
[GET] //.env
[GET] /cache/original/%2e%2e/.env
[GET] /.env.save
[GET] /api/fs/read
[GET] /agent/.env
[GET] /.aws/config
[GET] /config/.env.staging
[GET] /cmd/.env
[GET] /.docker/secrets.json
[GET] /pipeline/.env
[GET] /conf/.env
[GET] /userfiles
[GET] /service_account.json
[GET] /.env_sample
[GET] /docker-compose.prod.yml
[GET] /gcp-key.json
[GET] /
...(Truncated)
show less
Bad Web Bot
Exploited Host
Web App Attack
๐ช๐ธ
robotstxt
2026-10-21 05:13:37
(4 days ago)
136.108.244.132 - - [21/Oct/2026:05:13:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e ...
show more
136.108.244.132 - - [21/Oct/2026:05:13:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="136.108.244.132"
136.108.244.132 - - [21/Oct/2026:05:13:35 +0000] "GET /uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.108.244.132"
136.108.244.132 - - [21/Oct/2026:05:13:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.108.244.132"
136.108.244.132 - - [21/Oct/2026:05:13:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="136.108.244.132"
136.108.244.132 - - [21/Oct/2026:05:13:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="136.108.244.132"
...
show less
Web Spam
Web App Attack
๐บ๐ธ
Epimetheus
2026-10-21 05:03:02
(4 days ago)
Zombie network / Bot scanner detected:
[GET] /api/v1/auto_login
[POST] /login
[POST] /api/v1/valida ...
show more
Zombie network / Bot scanner detected:
[GET] /api/v1/auto_login
[POST] /login
[POST] /api/v1/validate/code
[POST] /api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow
[POST] /lib/file-control.php
[GET] /.env.ses
[GET] /@fs/proc/self/cwd/.env
[GET] /private-key
[GET] /public/.env
[GET] /sa.json
[GET] /.ssh/config
[GET] /.env.development.local
[GET] /.env.bak
[GET] /google-service-account.json
[POST] /api/route
[GET] /api/fs/read
[GET] /chatbot/.env
[GET] /frontend/.env
[GET] /bot/.env
[GET] /src/.env
[GET] /key.pem
[GET] /.docker/secrets.json
[GET] /@fs/home/ec2-user/.aws/credentials
[GET] /firebase-config.js
[GET] /.idea/WebServers.xml
[GET] /docker-compose.production.yml
[GET] /key.json
[GET] /push_config.json
[GET] /gcp-service.json
[GET] /common/.env
[GET] /.bashrc
[GET] /.env.development
[GET] /model/.env
[GET] /api/system/fileView
[GET] /cache/original/%2e%2e/.env
[GET] /prisma/.env
[GET] /.config/gcloud/application_default_credentials.json
[GET] /pag
...(Truncated)
show less
Bad Web Bot
Exploited Host
Web App Attack
๐บ๐ธ
zcampbell
2026-10-20 22:58:58
(4 days ago)
Web vulnerability scanning: probing for exposed sensitive files (.env). Detected and blocked automat ...
show more
Web vulnerability scanning: probing for exposed sensitive files (.env). Detected and blocked automatically.
show less
Web App Attack
Bad Web Bot
๐บ๐ธ
Epimetheus
2026-10-20 21:31:01
(4 days ago)
Zombie network / Bot scanner detected:
[POST] /flowise/api/v1/node-custom-function
[POST] /api/v1/b ...
show more
Zombie network / Bot scanner detected:
[POST] /flowise/api/v1/node-custom-function
[POST] /api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow
[POST] /api
[POST] /login
[POST] /lib/terminal-xhr.php
[POST] /settings
[POST] /app
[GET] /fly.toml
[GET] /api/..;/.env
[GET] /lib/.env
[GET] /id_ed25519
[GET] /terraform.tfstate
[GET] /pages/index.astro.mjs.map
[GET] /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ
[GET] /firebase-config.js
[GET] /prisma/.env
[GET] /.env.secret
[GET] /google-credentials.json
[GET] /firebase-credentials.json
[GET] /.git/config
[GET] /public/admin.json
[GET] /.bashrc
[GET] /.env.supabase
[GET] /infra/.env
[GET] /....//....//....//..../proc/self/environ
[GET] /static/..;/.env
[GET] /z9x8c7v6b5-debug-trigger-cloud.bgn.one
[GET] /config/.env
[GET] /assets/.env
[GET] /.env.development::$DATA
[GET] /@fs/root/.aws/credentials
[GET] /.env.production
[GET] /ml/.env
[GET] /gcp-service.json
[POST] /api/route
[GET] /api/uploads/
...(Truncated)
show less
Bad Web Bot
Exploited Host
Web App Attack
๐บ๐ธ
Epimetheus
2026-10-20 20:41:08
(4 days ago)
Zombie network / Bot scanner detected:
[GET] /docker-compose.prod.yml
[GET] /.env.local
[GET] /apps ...
show more
Zombie network / Bot scanner detected:
[GET] /docker-compose.prod.yml
[GET] /.env.local
[GET] /apps/.env
[GET] /api/orders/..%2f..%2f.env
[GET] /env/.env
[GET] /@fs/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
[POST] /api/route
[GET] /config/settings.local.yml
[GET] /api/orders/..%2f..%2fproc/self/environ
[GET] /.env.prod
[POST] /login
[GET] /.env_sample
[GET] /ai/.env
[POST] /dashboard
[GET] /services/.env
[GET] /ssl/localhost.key
[GET] /.env.production::$DATA
[GET] /.env.save
[GET] /agents/.env
[GET] /.ssh/config
[GET] /pages/api/index.astro.mjs.map
[GET] /terraform.tfvars
[GET] /.env
[GET] /id_ecdsa
[GET] /.env.backup
[GET] /web/.env
[GET] /.github/.env
[GET] /.env.development
[GET] /config/database.json
[GET] /ssl/server.key
[GET] /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ
[GET] /.env.key
[GET] /.env.local
[GET] /.envrc
[GET] /%2Fsettings
[POST] /settings
[GET] /id_rsa
[GET] /id_dsa
[GET] /model/.env
[GET] /.cache/huggingface/token
[GET] /.conf
...(Truncated)
show less
Bad Web Bot
Exploited Host
Web App Attack
๐บ๐ธ
Epimetheus
2026-10-20 18:01:05
(4 days ago)
Zombie network / Bot scanner detected:
[POST] /langflow/api/v1/validate/code
[GET] /data/.env
[GET] ...
show more
Zombie network / Bot scanner detected:
[POST] /langflow/api/v1/validate/code
[GET] /data/.env
[GET] /.docker/config.json
[GET] /.dev.vars.staging
[GET] /terraform.tfstate.backup
[GET] /.env
[GET] /static/.env
[GET] /deploy/.env
[GET] /panel/.env
[GET] /.env.live
[GET] /api/orders/..%2fadmin/config.json
[GET] /model/.env
[POST] /app
[GET] /.env.ses
[GET] /env/.env
[GET] /build/.env
[GET] /terraform.tfvars
[GET] /.env.local
[GET] /docker-compose.dev.yml
[GET] /%2Fsettings
[GET] /credentials.json
[GET] /.git/HEAD
[GET] /.env.development
[GET] /config/database.json
[GET] /%2Fdashboard
[GET] /prisma/.env
[GET] /%2Fapi/config
[GET] /agent/.env
[GET] /bot/.env
[GET] /.env.www
[GET] /dashboard%2F.env
[GET] /dashboard/members
[GET] /api/.env
[GET] /dist/manifest.json
[GET] /.htpasswd
[GET] /dashboard/webhooks
[GET] /serviceAccountKey.json
[GET] /.cargo/credentials.toml
[GET] /manage
[GET] /firebase-credentials.json
[GET] /auth/login
[GET] /.azure/accessTokens.json
[GET] /Dockerf
...(Truncated)
show less
Bad Web Bot
Exploited Host
Web App Attack
๐จ๐ฆ
cubie
2026-10-20 17:38:34
(4 days ago)
Port Scan: Admin Enumeration - Reported by CubieCloud Firewall [CFW_H574-009]
Port Scan
Anonymous
2026-10-20 17:24:42
(4 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
Anonymous
2026-10-20 17:22:49
(4 days ago)
136.108.244.132 - - [20/Oct/2026:12:22:48 -0500] "GET /.env.supabase HTTP/1.1" 403 199 "-" "Mozilla/ ...
show more
136.108.244.132 - - [20/Oct/2026:12:22:48 -0500] "GET /.env.supabase HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" 136.108.244.132
136.108.244.132 - - [20/Oct/2026:12:22:48 -0500] "GET /.env_1 HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )" 136.108.244.132
136.108.244.132 - - [20/Oct/2026:12:22:48 -0500] "GET /.env?import&raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot" 136.108.244.132
136.108.244.132 - - [20/Oct/2026:12:22:48 -0500] "GET /.env?raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 136.108.244.132
136.108.244.132 - - [20/Oct/2026:12:22:48 -0500] "GET /.env?import&url&inline HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like G
...
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
jormaster3k
2026-10-20 17:07:11
(4 days ago)
Attack against Apache (too many 404s)
Web App Attack
Anonymous
2026-10-20 16:48:13
(4 days ago)
Blocked by fail2ban on a public web server.
Web App Attack
Anonymous
2026-10-20 16:24:40
(4 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack