🇺🇸
han35
2026-11-10 06:00:11
UTC ·
(3 days ago)
ProtocolSecure - C2 honeypot hit: /api/cmd (kez: 5)
Hacking
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-11-09 20:09:42
UTC ·
(3 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-09 UTC.
Brute-Force
🇮🇹
CoreTech srl
2026-11-09 19:03:57
UTC ·
(3 days ago)
cloudlinux2 fail2ban: 2026-11-09 19:58:56,102 fail2ban.filter [1667]: INFO [plesk-wordpress] Found 91.193.232.77 - 2026-11-09 19:58:55cloudlinux2 fail2ban: 2026-11-09 19:59:06,022 fail2ban.filter [1667]: INFO [plesk-wordpress] F ...
show more
cloudlinux2 fail2ban: 2026-11-09 19:58:56,102 fail2ban.filter [1667]: INFO [plesk-wordpress] Found 91.193.232.77 - 2026-11-09 19:58:55cloudlinux2 fail2ban: 2026-11-09 19:59:06,022 fail2ban.filter [1667]: INFO [plesk-wordpress] Found 181.78.241.152 - 2026-11-09 19:59:05cloudlinux2 fail2ban: 2026-11-09 20:00:48,164 fail2ban.actions [1667]: NOTICE [plesk-modsecurity] Unban 34.146.100.193cloudlinux2 fail2ban: 2026-11-09 20:00:47,517 fail2ban.filter [1667]: INFO [plesk-modsecurity] Found 193.36.224.29 - 2026-11-09 20:00:47cloudlinux2 fail2ban: 2026-11-09 20:00:54,247 fail2ban.filter [1667]: INFO [plesk-wordpress] Found 155.2.215.31 - 2026-11-09 20:00:53cloudlinux2 fail2ban: 2026-11-09 20:00:54,288 fail2ban.filter [1667]: INFO [plesk-wordpress] Found 142.111.152.19 - 2026-11-09 20:00:53cloudlinux2 fail2ban: 2026-11-09 20:01:50,249 fail2ban.actions [1667]: NOTICE [plesk-modsecurity] Unban 34.27.217.235cloudlinux2 fail2ban: 2026-11-09 20:02:01,959
show less
Web App Attack
🇩🇪
LRob
2026-11-09 15:06:18
UTC ·
(4 days ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Bad Web Bot
🇩🇪
ghostwarriors
2026-11-09 14:50:22
UTC ·
(4 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-09 14:46:50
UTC ·
(4 days ago)
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /css../.env HTTP/2.0" 403 297 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /js../.env HTTP/2.0" 404 294 "-" "Mozilla/5.0 (compat ...
show more
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /css../.env HTTP/2.0" 403 297 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /js../.env HTTP/2.0" 404 294 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /assets../.env HTTP/2.0" 404 294 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /images../.env HTTP/2.0" 403 297 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0" 400 324 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
136.109.8.71 - - [09/Nov/2026:15:46:44 +0100] "GET /uploads../.env HTT
show less
Web App Attack
Hacking
Anonymous
2026-11-09 13:51:22
UTC ·
(4 days ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
ruusvuu
2026-11-09 13:48:51
UTC ·
(4 days ago)
Automated abuse report: 25 attack/probe requests from Google LLC / US.
Targeted paths: /.env.supabase, /.env.credentials, /.env.dev.local, /.env.keys, /fly.toml.
Sample log lines:
[proofpoll] 2026-11-09T13:48:49: 136.109.8.71 - [11/09/2026, 06:48:49] ...
show more
Automated abuse report: 25 attack/probe requests from Google LLC / US.
Targeted paths: /.env.supabase, /.env.credentials, /.env.dev.local, /.env.keys, /fly.toml.
Sample log lines:
[proofpoll] 2026-11-09T13:48:49: 136.109.8.71 - [11/09/2026, 06:48:49] "GET /v2/.env" 404 "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
[proofpoll] 2026-11-09T13:48:49: 136.109.8.71 - [11/09/2026, 06:48:49] "GET /.env.production.bak" 404 "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
[proofpoll] 2026-11-09T13:48:49: 136.109.8.71 - [11/09/2026, 06:48:49] "GET /.env.prod.bak" 404 "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
Detected by an automated web-server log monitor.
show less
Web App Attack
🇬🇧
gigatech
2026-11-09 13:10:03
UTC ·
(4 days ago)
Webserver Probing
Web App Attack
🇩🇪
ghel
2026-11-09 09:48:48
UTC ·
(4 days ago)
136.109.8.71 - - [09/Nov/2026:10:48:44 +0100] "GET /robots.txt HTTP/1.1" 403 572 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
136.109.8.71 - - [09/Nov/2026:10:48:45 +0100] "GET /sitemap_index.xml HTTP/1.1" ...
show more
136.109.8.71 - - [09/Nov/2026:10:48:44 +0100] "GET /robots.txt HTTP/1.1" 403 572 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
136.109.8.71 - - [09/Nov/2026:10:48:45 +0100] "GET /sitemap_index.xml HTTP/1.1" 404 569 "https://ptpz.net/sitemap_index.xml" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
136.109.8.71 - - [09/Nov/2026:10:48:45 +0100] "GET /static/manifest.json HTTP/1.1" 404 569 "https://ptpz.net/static/manifest.json" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
136.109.8.71 - - [09/Nov/2026:10:48:45 +0100] "GET /z9x8c7v6b5-debug-trigger-ptpz.net HTTP/1.1" 404 569 "https://ptpz.net/z9x8c7v6b5-debug-trigger-ptpz.net" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/
...
show less
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-11-09 09:30:06
UTC ·
(4 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
Bedios GmbH
2026-11-09 09:17:43
UTC ·
(4 days ago)
Scanning for exposed credentials and private keys.
Hacking
🇳🇱
Site.eu
2026-11-09 08:46:44
UTC ·
(4 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-09 08:35:26
UTC ·
(4 days ago)
Web attack/malicious scanning detected
Web App Attack
Anonymous
2026-11-09 08:18:02
UTC ·
(4 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking