🇩🇪
Bedios GmbH
2026-10-13 13:47:55
(4 hours ago)
Scanning for exposed credentials and private keys.
Hacking
🇬🇧
openstrike.co.uk
2026-10-13 05:16:39
(12 hours ago)
226 attacks on env grabbing URLs, directory traversals, config grabbing URLs (type 2), env grabbing ...
show more
226 attacks on env grabbing URLs, directory traversals, config grabbing URLs (type 2), env grabbing URLs (type 2), shell probes, password/key grabbing URLs, VC URLs, PHP URLs:
GET /....//....//....//..../.env HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /config/gcp-credentials.json HTTP/1.1
GET /static/..;/..;/..;/..;/proc/self/environ HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /.aws/credentials HTTP/1.1
GET /.git/config HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
🇨🇭
🇨🇭 Hosting
2026-10-13 05:10:17
(12 hours ago)
Automated WAF report: 400-500 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack
🇩🇰
Leif Neland
2026-10-13 01:00:06
(17 hours ago)
Detected by CrowdSec on slim
Brute-Force
🇩🇪
Bedios GmbH
2026-10-13 00:27:38
(17 hours ago)
Login credentials theft attempt
Hacking
2026-10-12 16:49:20
(1 day ago)
Aggressive web scan
Web App Attack
🇺🇸
RamSet
2026-10-12 15:41:03
(1 day ago)
[ycr] HTTP-Probe on port 443 (via domain). 175 distinct paths probed in 18s. Sustained 179 req/min, ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 175 distinct paths probed in 18s. Sustained 179 req/min, 171 nonexistent paths (404). Paths: /.aws/credentials, /dist/.env, /.git-credentials, /.aws/config, /build/.env, /core/.env, /.env.supabase, /.git/config, /docker/.env, /.git/HEAD, /.next/.env, /secrets.env, /.htpasswd, /.env.credentials, /.env.secret, /.env.staging.local, /.env.production.local, /.env.dev.local, /.ssh/id_ed25519, /.env.preprod, /.ssh/config, /.env.keys, /.ssh/id_rsa, /@fs/../.env?raw??, /.env.config, /@fs/app/.env?raw??, /@fs/src/.env?raw??, /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??, /.env.prod.local, /.env.development.local, /.env.testing, /@fs/.env?raw&url??, /@fs/var/task/.env?raw??, /@fs/app/.env.local?import&raw??, /@fs/src/.env?import&raw??, /@fs/.env?url&raw??, /@fs/home/ubuntu/.aws/credentials?raw??, /@fs/proc/self/cwd/.env?raw??, /@fs/home/ec2-user/.aws/credentials?raw??, /@fs/app/.env.production?import&raw??, …
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-12 15:27:34
(1 day ago)
[ti-27al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-27al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 136.85.103.28 - - [12/Oct/2026:17:27:16 +0200] "GET /.env.supabase HTTP/1.1" 404 2065 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
136.85.103.28 - - [12/Oct/2026:17:27:16 +0200] "GET /static//.env HTTP/1.1" 403 584 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 15:10:00
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 136.85.103.28 (28.103.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.103.28 (28.103.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 11:09:55.302599 2026] [security2:error] [pid 7836:tid 7836] [client 136.85.103.28:60444] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||yakarinc.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "yakarinc.com"] [uri "/z9x8c7v6b5-debug-trigger-yakarinc.com"] [unique_id "asz4Q0_HbYcseSVxPZpvfQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
xyz.rip
2026-10-12 14:30:51
(1 day ago)
WAF Violation
...
Hacking
Web App Attack
🇩🇪
ger-stg-sifi1
2026-10-12 14:30:44
(1 day ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 14:28:19
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 136.85.103.28 (28.103.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.103.28 (28.103.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:28:12.814391 2026] [security2:error] [pid 21213:tid 21213] [client 136.85.103.28:58838] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||xyncom.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "xyncom.com"] [uri "/z9x8c7v6b5-debug-trigger-xyncom.com"] [unique_id "aszufPwKJDRT5tJLNc2HvQAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-12 12:17:26
(1 day ago)
29.686 requests from untrusted country (6d8h35m)
Brute-Force
Bad Web Bot
🇫🇷
Octopuce
2026-10-12 12:00:07
(1 day ago)
Aggressive web search of vulnerable pages: / /static//home/user/.env /static//app/.env /.//.env /sta ...
show more
Aggressive web search of vulnerable pages: / /static//home/user/.env /static//app/.env /.//.env /static../.env ...
show less
Web App Attack
2026-10-12 12:00:07
(1 day ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
