🇬🇧
openstrike.co.uk
2026-10-23 05:15:28
(33 minutes ago)
3 attacks on password/key grabbing URLs:
GET /.aws/credentials.bak HTTP/1.1
Hacking
🇧🇪
taivas.nl
2026-10-23 04:37:56
(1 hour ago)
Many_bad_calls
Web App Attack
2026-10-23 04:32:55
(1 hour ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇨🇦
innov8ideas4u
2026-10-23 03:16:24
(2 hours ago)
Honeypot: stolen credential use. Scraped planted .env files (60 requests), then used a planted canar ...
show more
Honeypot: stolen credential use. Scraped planted .env files (60 requests), then used a planted canary AWS key. Activity: SES email abuse checks, IAM backdoor attempts (CreateUser/CreateAccessKey), EC2 enumeration. API calls seen: AttachRolePolicy, CreateAccessKey, CreateUser, DeleteAccessKey, DescribeInstances, DetachRolePolicy, DetachUserPolicy, GetAccountSendingEnabled, GetSendQuota, GetSendStatistics, GetUser, ListIdentities.
show less
Web App Attack
Hacking
🇺🇸
MatCat
2026-10-23 03:05:10
(2 hours ago)
Banned by fail2ban: apache-webprobe
Port Scan
Bad Web Bot
🇩🇪
SCHAPPY
2026-10-23 03:00:07
(2 hours ago)
Malicious activity from IP detected: crowdsecurity/http-sensitive-files.
Web App Attack
Hacking
🇵🇱
lns.bz
2026-10-23 02:55:36
(2 hours ago)
Web app attack [PL.Lu]
Exploited Host
Web App Attack
🇩🇪
konseptit
2026-10-23 02:55:02
(2 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 34.140.31.161 (BE/Belgium/161.31.140.34 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.140.31.161 (BE/Belgium/161.31.140.34.bc.googleusercontent.com)
show less
SQL Injection
2026-10-23 02:52:57
(2 hours ago)
[Fri Oct 23 04:52:56.545597 2026] [proxy_fcgi:error] [pid 2985:tid 3037] [client 34.140.31.161:34936 ...
show more
[Fri Oct 23 04:52:56.545597 2026] [proxy_fcgi:error] [pid 2985:tid 3037] [client 34.140.31.161:34936] AH01071: Got error 'Primary script unknown'
[Fri Oct 23 04:52:56.560966 2026] [proxy_fcgi:error] [pid 2985:tid 3029] [client 34.140.31.161:34894] AH01071: Got error 'Primary script unknown'
[Fri Oct 23 04:52:56.605171 2026] [proxy_fcgi:error] [pid 1338:tid 1403] [client 34.140.31.161:34860] AH01071: Got error 'Primary script unknown'
[Fri Oct 23 04:52:56.626092 2026] [proxy_fcgi:error] [pid 2985:tid 3017] [client 34.140.31.161:34890] AH01071: Got error 'Primary script unknown'
[Fri Oct 23 04:52:56.656209 2026] [proxy_fcgi:error] [pid 15001:tid 15045] [client 34.140.31.161:34934] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
Web App Attack
🇩🇪
4server
2026-10-23 02:51:53
(2 hours ago)
[FriOct2304:51:51.6704532026][security2:error][pid2022981:tid2023072][client34.140.31.161:0]ModSecur ...
show more
[FriOct2304:51:51.6704532026][security2:error][pid2022981:tid2023072][client34.140.31.161:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"akastudio.ch\"][uri\"/.aws/credentials\"][unique_id\"atrLx-UsOTZmUCAg52sgTAAAAUM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-10-23 02:45:05
(3 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
UnixPrime
2026-10-23 02:32:18
(3 hours ago)
34.140.31.161 - - [23/Oct/2026:04:32:18 +0200] "GET /phpinfo.php HTTP/1.1" 404 118 "-" "Mozilla/5.0 ...
show more
34.140.31.161 - - [23/Oct/2026:04:32:18 +0200] "GET /phpinfo.php HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
34.140.31.161 - - [23/Oct/2026:04:32:18 +0200] "GET /info.php HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
WizardsToolkit
2026-10-23 02:09:32
(3 hours ago)
tried to access forbidden files; attempted to access /app/.env
Web App Attack
🇺🇸
fazar
2026-10-23 02:00:37
(3 hours ago)
crowdsecurity/http-admin-interface-probing on node: us01
Web App Attack
Hacking
🇮🇹
CoreTech srl
2026-10-23 01:58:51
(3 hours ago)
cloudlinux2 fail2ban: 2026-10-23 03:54:13,004 fail2ban.filter [1488]: INFO [plesk-modsecu ...
show more
cloudlinux2 fail2ban: 2026-10-23 03:54:13,004 fail2ban.filter [1488]: INFO [plesk-modsecurity] Found 34.140.31.161 - 2026-10-23 03:54:12cloudlinux2 fail2ban: 2026-10-23 03:54:13,021 fail2ban.filter [1488]: INFO [plesk-modsecurity] Found 34.140.31.161 - 2026-10-23 03:54:12cloudlinux2 fail2ban: 2026-10-23 03:54:13,013 fail2ban.filter [1488]: INFO [plesk-modsecurity] Found 34.140.31.161 - 2026-10-23 03:54:12cloudlinux2 fail2ban: 2026-10-23 03:54:13,037 fail2ban.filter [1488]: INFO [plesk-modsecurity] Found 34.140.31.161 - 2026-10-23 03:54:12cloudlinux2 fail2ban: 2026-10-23 03:54:12,996 fail2ban.filter [1488]: INFO [plesk-modsecurity] Found 34.140.31.161 - 2026-10-23 03:54:12cloudlinux2 fail2ban: 2026-10-23 03:54:13,075 fail2ban.filter [1488]: INFO [plesk-modsecurity] Found 34.140.31.161 - 2026-10-23 03:54:12cloudlinux2 fail2ban: 2026-10-23 03:54:13,029 fail2ban.filter [1488]: INFO [plesk-modsecurity] Found 34.140.31.161 - 2026-10-23 03:
show less
Brute-Force