🇬🇧
openstrike.co.uk
2026-10-13 05:15:54
(2 days ago)
226 attacks on directory traversals, env grabbing URLs, config grabbing URLs (type 2), PHP URLs, VC ...
show more
226 attacks on directory traversals, env grabbing URLs, config grabbing URLs (type 2), PHP URLs, VC URLs, shell probes, password/key grabbing URLs, env grabbing URLs (type 2):
GET /..%2f.env HTTP/1.1
GET /prisma/.env HTTP/1.1
GET /config/settings.local.yml HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /.git/config HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /id_ed25519 HTTP/1.1
GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/1.1
show less
Hacking
Web App Attack
🇨🇭
🇨🇭 Hosting
2026-10-13 05:10:12
(2 days ago)
Automated WAF report: 600-700 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack
🇨🇱
Fernando Soto
2026-10-13 03:05:33
(2 days ago)
WAF propio vps1 (CL): sensMASx195 score 30 en 1h. sondeo rutas sensibles.
Web App Attack
2026-10-12 15:45:16
(2 days ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-12 15:40:24
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.134.157.66 (66.157.134.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.134.157.66 (66.157.134.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 11:40:20.367922 2026] [security2:error] [pid 30781:tid 30913] [client 34.134.157.66:35120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "soluciona.biz"] [uri "/.next/.env"] [unique_id "asz_ZEvA3nSA_c4cuVfoNQAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-12 15:29:06
(2 days ago)
Blocked by fail2ban on a public web server.
Web App Attack
🇦🇺
clapper
2026-10-12 15:17:02
(2 days ago)
(mod_security) mod_security (id:980001) triggered by 34.134.157.66 (US/United States/66.157.134.34.b ...
show more
(mod_security) mod_security (id:980001) triggered by 34.134.157.66 (US/United States/66.157.134.34.bc.googleusercontent.com): 5 in the last 3600 secs; ID: Clar
show less
Brute-Force
Bad Web Bot
🇩🇪
sternwart
2026-10-12 15:00:56
(2 days ago)
Automatisch erkannt: Zugriff auf /images../.env (my-coach.ch)
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-12 14:45:00
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.134.157.66 (66.157.134.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.134.157.66 (66.157.134.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:44:55.852015 2026] [security2:error] [pid 1379:tid 1379] [client 34.134.157.66:52914] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lopansri.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lopansri.com"] [uri "/z9x8c7v6b5-debug-trigger-lopansri.com"] [unique_id "aszyZ8Axm-jx2WYSJj-C_wAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
/dev/null
2026-10-12 14:29:37
(2 days ago)
Web attack | malicious scanning detected.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 14:23:08
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.134.157.66 (66.157.134.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.134.157.66 (66.157.134.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:23:05.073374 2026] [security2:error] [pid 19191:tid 19191] [client 34.134.157.66:47332] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||hyps.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hyps.com"] [uri "/z9x8c7v6b5-debug-trigger-hyps.com"] [unique_id "asztSVnxfbHIxYzpxLywmQAAADI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-12 14:21:04
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 34.134.157.66 (US/United States/66.157.134.34.b ...
show more
(mod_security) mod_security (id:949110) triggered by 34.134.157.66 (US/United States/66.157.134.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇩🇪
FD-IX
2026-10-12 14:18:29
(2 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇨🇱
Fernando Soto
2026-10-12 14:05:02
(3 days ago)
WAF propio vps1 (CL): 404x16,sensMASx195 score 30 en 1h. sondeo rutas sensibles, barrido 404.
Port Scan
Web App Attack
🇩🇪
FeG Deutschland
2026-10-12 14:03:02
(3 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1248
Exploited Host
Web App Attack
