🇩🇪
big-cloud.nl
2026-10-13 15:22:10
(35 minutes ago)
Try to access /.//.env
Web App Attack
🇫🇷
Lacrimosa99
2026-10-13 14:11:09
(1 hour ago)
136.86.198.68 - - [13/Oct/2026:16:11:08 +0200] "GET /admin%2F.env HTTP/2.0" 404 224 "-" "Mozilla/5.0 ...
show more
136.86.198.68 - - [13/Oct/2026:16:11:08 +0200] "GET /admin%2F.env HTTP/2.0" 404 224 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
136.86.198.68 - - [13/Oct/2026:16:11:08 +0200] "GET /.dbeaver/credentials-config.json HTTP/2.0" 404 224 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
136.86.198.68 - - [13/Oct/2026:16:11:08 +0200] "GET /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ HTTP/2.0" 404 224 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
...
show less
Web Spam
🇳🇱
Site.eu
2026-10-13 13:37:52
(2 hours ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
FeG Deutschland
2026-10-13 13:12:54
(2 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1248
Exploited Host
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-13 12:43:00
(3 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇫🇷
security.rdmc.fr
2026-10-13 12:42:08
(3 hours ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 11:59:02
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.86.198.68 (68.198.86.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.86.198.68 (68.198.86.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:58:57.484676 2026] [security2:error] [pid 31813:tid 31813] [client 136.86.198.68:44616] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dudleyanddudley.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dudleyanddudley.com"] [uri "/z9x8c7v6b5-debug-trigger-dudleyanddudley.com"] [unique_id "as4dAf4-DssNSqkPg0XQJgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-13 11:35:57
(4 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
🇳🇱
Alt255
2026-10-13 11:08:34
(4 hours ago)
[cb-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 136.86.198.68 - - [13/Oct/2026:13:08:22 +0200] "GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env HTTP/1.0" 503 845 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 11:07:42
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.86.198.68 (68.198.86.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.86.198.68 (68.198.86.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:07:38.500035 2026] [security2:error] [pid 2725:tid 2725] [client 136.86.198.68:36096] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dunningtons.com"] [uri "/js../.env"] [unique_id "as4Q-mHnfLsb8zv0rbXvrgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-13 11:07:01
(4 hours ago)
Multiple WAF Violations
Web App Attack
🇧🇪
cmbplf
2026-10-13 10:59:53
(4 hours ago)
357 requests with url.path */@fs/*
227 requests with url.path */proc/*
112 requests with url.path ...
show more
357 requests with url.path */@fs/*
227 requests with url.path */proc/*
112 requests with url.path *credentials.json
106 requests with url.path *.ssh/*
show less
Brute-Force
Bad Web Bot
🇺🇸
Epimetheus
2026-10-13 10:54:28
(5 hours ago)
Zombie network / Bot scanner detected:
[POST] /webhook-test/
[POST] /feast/read-document
[POST] /fe ...
show more
Zombie network / Bot scanner detected:
[POST] /webhook-test/
[POST] /feast/read-document
[POST] /feast/read-document
[POST] /cgi-bin/php
[POST] /php-cgi/php-cgi.exe
[POST] /api/templates/preview
[POST] /api/v1/node-load-method/customMCP
[POST] /cgi-bin/php-cgi
[POST] /api/v1/validate/code
[POST] /api/designer/v1/file-content
[POST] /form/
[POST] /webhook-test/
[GET] /.env
[GET] /panel/.env
[GET] /serverless.yaml
[GET] /store/.env
[GET] /docker-compose.production.yml
[GET] /portal/.env
[GET] /.ssh/id_dsa
[GET] /.terraform/terraform.tfstate
[GET] /supabase/.env
[GET] /.env.ses
[GET] /conf/.env
[GET] /.env.smtp
[GET] /.env_1
[POST] /read-document
[GET] /firebaseConfig.js
[GET] /@fs/var/run/secrets/kubernetes.io/serviceaccount/token
[GET] /private/.env
[GET] /.env.local
[GET] /terraform.tfvars
[GET] /ml/.env
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)
show less
Bad Web Bot
Exploited Host
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-13 10:54:19
(5 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773
Web App Attack
Hacking
🇳🇱
Savvii
2026-10-13 10:48:33
(5 hours ago)
20 attempts against mh_ha-misbehave-ban on boron
Brute-Force
Bad Web Bot
Web App Attack
