🇬🇧
openstrike.co.uk
2026-10-13 05:16:17
(9 hours ago)
226 attacks on config grabbing URLs (type 2), env grabbing URLs, directory traversals, shell probes, ...
show more
226 attacks on config grabbing URLs (type 2), env grabbing URLs, directory traversals, shell probes, env grabbing URLs (type 2), password/key grabbing URLs, VC URLs, PHP URLs:
GET /config/database.json HTTP/1.1
GET /prisma/.env HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
GET /.git/HEAD HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
Philister11
2026-10-13 01:00:12
(13 hours ago)
CrowdSec: crowdsecurity/http-path-traversal-probing (US/AS396982)
Web App Attack
Hacking
🇫🇷
SpaceHost-Server
2026-10-12 22:15:13
(16 hours ago)
Brute-Force
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-12 17:45:55
(20 hours ago)
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.1 ...
show more
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.187, server: api.betatechnologies.info, request: "GET /img../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.187, server: api.betatechnologies.info, request: "GET /build../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/12 18:45:54 [error] 4060693#4060693: *2567995 access forbidden by rule, client: 136.67.160.187, server: api.betatechnologies.info, request: "GET /media../.env HTTP/2.0", host: "api.betatechnologies.info"
show less
Brute-Force
Web App Attack
🇩🇪
XICTRON
2026-10-12 16:55:07
(21 hours ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
2026-10-12 16:49:35
(21 hours ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 136.67.160.187 (187.160.67.136.bc.googleuser ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 136.67.160.187 - - [12/Oct/2026:18:49:31 +0200] "GET /static//.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
136.67.160.187 - - [12/Oct/2026:18:49:31 +0200] "GET /css../.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
136.67.160.187 - - [12/Oct/2026:18:49:31 +0200] "GET /public../.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
show less
Port Scan
🇳🇱
Site.eu
2026-10-12 16:34:58
(22 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-12 16:34:47
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:34:41.384832 2026] [security2:error] [pid 30571:tid 30571] [client 136.67.160.187:57122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xrp589.info"] [uri "/media../.env"] [unique_id "as0MIccnhKqKGdNBr6VnxQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Nevermind
2026-10-12 16:17:09
(22 hours ago)
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /serviceAccountKey.json HTTP/1.1" 404 5695 "-" ...
show more
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /serviceAccountKey.json HTTP/1.1" 404 5695 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1" 404 5483 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
136.67.160.187 - - [12/Oct/2026:18:17:08 +0200] "GET /docker-compose.yml HTTP/1.1" 404 5695 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.67.160.187 - - [12/Oct/2026:18:17:09 +0200] "GET /docker-compose.yaml HTTP/1.1" 404 5695 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 16:16:09
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.160.187 (187.160.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:16:03.268552 2026] [security2:error] [pid 8919:tid 8919] [client 136.67.160.187:42218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "solarfarms.info"] [uri "/uploads../.env"] [unique_id "as0Hw9uVW5YA4roMDc_vOQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-10-12 16:13:00
(22 hours ago)
2026-10-12 18:11:45 AH10244: invalid URI path (/%2e%2e/.env) && 2026-10-12 18:11:45 AH10244: invalid ...
show more
2026-10-12 18:11:45 AH10244: invalid URI path (/%2e%2e/.env) && 2026-10-12 18:11:45 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ) && 2026-10-12 18:11:46 AH10244: invalid URI path (/appearance/../../proc/self/environ) && 231 more within 20 minutes
show less
Web App Attack
🇺🇸
n2nguyenn2nguyen
2026-10-12 15:50:50
(22 hours ago)
Blocked by YFC Security on https://1904.brixzly.com — type: directory_scan_attempts
Web App Attack
2026-10-12 15:03:52
(23 hours ago)
[Mon Oct 12 17:03:49.992618 2026] [access_compat:error] [pid 3615746:tid 3615746] [client 136.67.160 ...
show more
[Mon Oct 12 17:03:49.992618 2026] [access_compat:error] [pid 3615746:tid 3615746] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.dockerenv, referer: https://loretlargent.info/.dockerenv
[Mon Oct 12 17:03:50.368548 2026] [access_compat:error] [pid 3615746:tid 3615746] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/server.key, referer: https://loretlargent.info/server.key
[Mon Oct 12 17:03:50.375829 2026] [access_compat:error] [pid 3615695:tid 3615695] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/...., referer: https://loretlargent.info/....//....//....//..../proc/self/environ
[Mon Oct 12 17:03:50.426272 2026] [access_compat:error] [pid 3616488:tid 3616488] [client 136.67.160.187:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/key.pem, referer: https://lore
...
show less
Web Spam
Web App Attack
🇩🇪
LRob
2026-10-12 14:47:59
(23 hours ago)
Crawler ignoring refusals | ua: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/), Moz ...
show more
Crawler ignoring refusals | ua: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/), Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/ (+11 more) | path: /6hfzjzh6m7f1cg11grrd, /manifest.json, /asset-manifest.json (+17 more)
show less
Bad Web Bot
🇺🇸
kosada.com
2026-10-12 14:34:56
(1 day ago)
Repeated requests for suspicious nonexistent URLs, for example: /frontend/.env (HTTP/2.0 port 443, u ...
show more
Repeated requests for suspicious nonexistent URLs, for example: /frontend/.env (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)")
show less
Web App Attack
