🇳🇱
Alt255
2026-11-07 02:28:13
UTC ·
(2 hours ago)
[ti-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.71.210.39 - - [07/Nov/2026:03:27:55 +0100] "GET /config/.env HTTP/2.0" 404 1878 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 ...
show more
[ti-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.71.210.39 - - [07/Nov/2026:03:27:55 +0100] "GET /config/.env HTTP/2.0" 404 1878 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇯🇵
Kinsei Engineering Inc.
2026-11-06 22:55:29
UTC ·
(6 hours ago)
2026/11/07 07:55:28 [error] 330962#330962: *71776 access forbidden by rule, client: 167.71.210.39, server: www.kinsei.jp, request: "GET /.env.old HTTP/2.0", host: "www.kinsei.jp", referrer: "https://kinsei.jp/.env.old"
2026/11/07 07:55:28 [error] 330 ...
show more
2026/11/07 07:55:28 [error] 330962#330962: *71776 access forbidden by rule, client: 167.71.210.39, server: www.kinsei.jp, request: "GET /.env.old HTTP/2.0", host: "www.kinsei.jp", referrer: "https://kinsei.jp/.env.old"
2026/11/07 07:55:28 [error] 330962#330962: *71776 access forbidden by rule, client: 167.71.210.39, server: www.kinsei.jp, request: "GET /.env HTTP/2.0", host: "www.kinsei.jp", referrer: "https://kinsei.jp/.env"
2026/11/07 07:55:28 [error] 330962#330962: *71776 access forbidden by rule, client: 167.71.210.39, server: www.kinsei.jp, request: "GET /api/.env HTTP/2.0", host: "www.kinsei.jp", referrer: "https://kinsei.jp/api/.env"
show less
Brute-Force
Web Spam
🇺🇸
Starburst SysOp Team
2026-11-06 22:42:18
UTC ·
(6 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .d ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-mnz6-1)
show less
Hacking
🇺🇸
wordpresshosting.solutions
2026-11-06 22:17:33
UTC ·
(6 hours ago)
Web brute-force / failed auth detected
Brute-Force
Web App Attack
🇫🇷
regishoussin
2026-11-06 19:46:08
UTC ·
(9 hours ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-06 19:46 UTC.
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-11-06 19:18:01
UTC ·
(9 hours ago)
20 attempts against mh-misbehave-ban on grape
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
tr1n
2026-11-06 17:52:39
UTC ·
(11 hours ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action: BLOCK | ASN: 14061 (DigitalOcean, LLC) | Protocol: HTTP/2 (GET) | Endpoint: /config/auth.json | Timestamp: 2026-11-06T17:52:39Z | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action: BLOCK | ASN: 14061 (DigitalOcean, LLC) | Protocol: HTTP/2 (GET) | Endpoint: /config/auth.json | Timestamp: 2026-11-06T17:52:39Z | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
show less
Bad Web Bot
🇧🇷
radardatelecom
2026-11-06 16:54:05
UTC ·
(12 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇺🇸
brightenfield
2026-11-06 15:25:46
UTC ·
(13 hours ago)
Web App Attack
Web App Attack
🇩🇪
svr
2026-11-06 14:50:50
UTC ·
(14 hours ago)
Abusive Automated Web Scanner
Web App Attack
2026-11-06 13:48:47
UTC ·
(15 hours ago)
Automatically blocked after 5 security events. Observed sensitive configuration-file probes. Source: Cloudflare security controls.
Hacking
Web App Attack
🇳🇱
ams_sec_user
2026-11-06 13:05:24
UTC ·
(15 hours ago)
Automated requests against a hosted website: 34 requests between 12:00 and 12:59 UTC; 9 probes for exposed secrets/config files (/phpinfo, /_profiler/phpinfo, /.env.local). Reported automatically.
Hacking
Bad Web Bot
Web App Attack
2026-11-06 10:17:43
UTC ·
(18 hours ago)
167.71.210.39 - - [06/Nov/2026:18:17:41 +0800] "GET /api/.env HTTP/2.0" 404 170 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
167.71.210.39 - - [06/Nov/2026:18:17:41 +0800] "GET ...
show more
167.71.210.39 - - [06/Nov/2026:18:17:41 +0800] "GET /api/.env HTTP/2.0" 404 170 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
167.71.210.39 - - [06/Nov/2026:18:17:41 +0800] "GET /backend/.env HTTP/2.0" 404 170 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-11-06 09:49:43
UTC ·
(19 hours ago)
(credential-hunter) Failed credential-hunter trigger with match [redacted] from 167.71.210.39 (SG/Singapore/-): (CF_ENABLE)
Hacking
🇺🇸
interbiznw.com
2026-11-06 08:31:15
UTC ·
(20 hours ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
