๐จ๐ญ
leo1305
2026-10-09 05:30:57
(15 hours ago)
CrowdSec detection | scenario: http-sensitive-files
Web App Attack
Exploited Host
Anonymous
2026-10-09 04:17:27
(16 hours ago)
136.111.188.224 - - [09/Oct/2026:06:17:26 +0200] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self ...
show more
136.111.188.224 - - [09/Oct/2026:06:17:26 +0200] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
136.111.188.224 - - [09/Oct/2026:06:17:26 +0200] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
136.111.188.224 - - [09/Oct/2026:06:17:27 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/2.0" 404 288 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)"
136.111.188.224 - - [09/Oct/2026:06:17:27 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
136.111.188.224 - - [09/Oct/2026:06:17:27 +0200] "GET /admin%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, l
...
show less
Brute-Force
SSH
๐บ๐ธ
abuse-opdc
2026-10-09 03:35:58
(17 hours ago)
Malicious HTTP requests matching injection/exploit signatures.
Web App Attack
Brute-Force
Anonymous
2026-10-09 03:29:44
(17 hours ago)
136.111.188.224 - - [09/Oct/2026:05:29:43 +0200] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 ...
show more
136.111.188.224 - - [09/Oct/2026:05:29:43 +0200] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
136.111.188.224 - - [09/Oct/2026:05:29:43 +0200] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
136.111.188.224 - - [09/Oct/2026:05:29:43 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
136.111.188.224 - - [09/Oct/2026:05:29:43 +0200] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
136.111.188.224 - - [09/Oct/2026:05:29:44 +0200] "GET /admin%2F.env HTTP/2.0" 404 265 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
...
show less
Brute-Force
SSH
Anonymous
2026-10-09 02:48:32
(18 hours ago)
136.111.188.224 - - [09/Oct/2026:04:48:32 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/s ...
show more
136.111.188.224 - - [09/Oct/2026:04:48:32 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
136.111.188.224 - - [09/Oct/2026:04:48:32 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
136.111.188.224 - - [09/Oct/2026:04:48:32 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
136.111.188.224 - - [09/Oct/2026:04:48:32 +0200] "GET /appearance/../../.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
136.111.188.224 - - [09/Oct/2026:04:48:32 +0200] "GET /appearance/../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Baiduspide
...
show less
Brute-Force
SSH
๐บ๐ธ
consti.art
2026-10-09 02:36:48
(18 hours ago)
Exploit attempts targeting CVE-2025-55182 (8 requests)
Web vulnerability scanning (581 probes), look ...
show more
Exploit attempts targeting CVE-2025-55182 (8 requests)
Web vulnerability scanning (581 probes), looking for path traversal, configuration and credential files, framework debug endpoints, PHP scripts and web shells, router and IoT management interfaces, CMS admin and login pages
HTTP flood: 241 requests in a short period
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; c
1,275 HTTP requests between 2026-10-08 17:13 and 2026-10-09 02:36 UTC
show less
Hacking
Bad Web Bot
Web App Attack
Anonymous
2026-10-09 01:58:52
(19 hours ago)
136.111.188.224 - - [09/Oct/2026:03:58:50 +0200] "GET /public/plugins/text/../../../../../../../../p ...
show more
136.111.188.224 - - [09/Oct/2026:03:58:50 +0200] "GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)"
136.111.188.224 - - [09/Oct/2026:03:58:50 +0200] "GET /.htpasswd HTTP/2.0" 403 272 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
136.111.188.224 - - [09/Oct/2026:03:58:52 +0200] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
136.111.188.224 - - [09/Oct/2026:03:58:52 +0200] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.111.188.224 - - [09/Oct/2026:03:58:52 +0200] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
...
show less
Brute-Force
SSH
Anonymous
2026-10-09 01:22:34
(19 hours ago)
136.111.188.224 - - [09/Oct/2026:03:22:33 +0200] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "CCBot/2.0 ...
show more
136.111.188.224 - - [09/Oct/2026:03:22:33 +0200] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
136.111.188.224 - - [09/Oct/2026:03:22:33 +0200] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
136.111.188.224 - - [09/Oct/2026:03:22:33 +0200] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"
136.111.188.224 - - [09/Oct/2026:03:22:33 +0200] "GET /settings%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
136.111.188.224 - - [09/Oct/2026:03:22:33 +0200] "GET /resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
...
show less
Brute-Force
SSH
๐ช๐ธ
robotstxt
2026-10-09 01:12:05
(20 hours ago)
136.111.188.224 - - [09/Oct/2026:01:11:43 +0000] "GET /z9x8c7v6b5-debug-trigger-intranet.ccoo.app HT ...
show more
136.111.188.224 - - [09/Oct/2026:01:11:43 +0000] "GET /z9x8c7v6b5-debug-trigger-intranet.ccoo.app HTTP/2.0" 403 27829 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot" "136.111.188.224" edge="104.22.1.225"
136.111.188.224 - - [09/Oct/2026:01:11:43 +0000] "GET /login/ HTTP/2.0" 403 2 "https://intranet.ccoo.app/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "136.111.188.224" edge="104.22.1.225"
136.111.188.224 - - [09/Oct/2026:01:11:43 +0000] "GET /auth/login/ HTTP/2.0" 403 27829 "https://intranet.ccoo.app/auth/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "136.111.188.224" edge="104.22.1.225"
136.111.188.224 - - [09/Oct/2026:01:11:43 +0000] "GET /secure/ HTTP/2.0" 403 27829 "https://intranet.ccoo.app/secure
...
show less
Web App Attack
Anonymous
2026-10-09 00:37:23
(20 hours ago)
136.111.188.224 - - [09/Oct/2026:02:37:22 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f.env HTTP/2.0" ...
show more
136.111.188.224 - - [09/Oct/2026:02:37:22 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot"
136.111.188.224 - - [09/Oct/2026:02:37:22 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
136.111.188.224 - - [09/Oct/2026:02:37:22 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
136.111.188.224 - - [09/Oct/2026:02:37:22 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
136.111.188.224 - - [09/Oct/2026:02:37:22 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E
...
show less
Brute-Force
SSH
๐ฆ๐บ
Klaverstyn
2026-10-09 00:25:01
(20 hours ago)
Persistent attacker, repeat offender
Hacking
Anonymous
2026-10-09 00:05:19
(21 hours ago)
136.111.188.224 - - [09/Oct/2026:02:05:17 +0200] "GET /static/../../../a/../../../../proc/self/envir ...
show more
136.111.188.224 - - [09/Oct/2026:02:05:17 +0200] "GET /static/../../../a/../../../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
136.111.188.224 - - [09/Oct/2026:02:05:17 +0200] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
136.111.188.224 - - [09/Oct/2026:02:05:17 +0200] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
136.111.188.224 - - [09/Oct/2026:02:05:17 +0200] "GET /admin%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
136.111.188.224 - - [09/Oct/2026:02:05:17 +0200] "GET /dashboard%2F.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
...
show less
Brute-Force
SSH
Anonymous
2026-10-08 23:34:25
(21 hours ago)
136.111.188.224 - - [09/Oct/2026:01:34:23 +0200] "GET /public/plugins/text/../../../../../../../../p ...
show more
136.111.188.224 - - [09/Oct/2026:01:34:23 +0200] "GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.111.188.224 - - [09/Oct/2026:01:34:24 +0200] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.111.188.224 - - [09/Oct/2026:01:34:24 +0200] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
136.111.188.224 - - [09/Oct/2026:01:34:24 +0200] "GET /..%2f..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
136.111.188.224 - - [09/Oct/2026:01:34:24 +0200] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
...
show less
Brute-Force
SSH
Anonymous
2026-10-08 23:03:51
(22 hours ago)
136.111.188.224 - - [09/Oct/2026:01:03:50 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0" 40 ...
show more
136.111.188.224 - - [09/Oct/2026:01:03:50 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"
136.111.188.224 - - [09/Oct/2026:01:03:50 +0200] "GET /appearance/../../.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
136.111.188.224 - - [09/Oct/2026:01:03:50 +0200] "GET /..%2f.env HTTP/2.0" 404 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
136.111.188.224 - - [09/Oct/2026:01:03:50 +0200] "GET /appearance/../../proc/self/environ HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.111.188.224 - - [09/Oct/2026:01:03:50 +0200] "GET /%2e%2e/.env HTTP/2.0" 400 295 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
...
show less
Brute-Force
SSH
๐ง๐ท
radardatelecom
2026-10-08 22:27:13
(22 hours ago)
Blocked by Radar da Telecom firewall โ abuseipdb
Bad Web Bot
Web App Attack