2026-09-18 13:21:38
(1 hour ago)
Portscan: TCP/8443 (9x), TCP/8080 (7x)
Port Scan
🇪🇸
el-brujo
2026-09-18 03:28:38
(11 hours ago)
18/Sep/2026:05:28:37.461498 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
18/Sep/2026:05:28:37.461498 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.143.149.232] ModSecurity: Warning. Pattern match "(?i)(?:\\\\\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "grafana.elhacker.net"] [uri "/@fs/..%2f..%2f..%2f..%2f..
...
show less
Hacking
Web App Attack
🇩🇪
FeG Deutschland
2026-09-18 02:16:24
(12 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
2026-09-17 21:17:23
(17 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇬🇧
Marten Mark
2026-09-17 15:43:03
(23 hours ago)
34.143.149.232 - - [17/Sep/2026:15:42:59 +0000] "GET /.dockerenv HTTP/2.0" 404 1448 "-" "Mozilla/5.0 ...
show more
34.143.149.232 - - [17/Sep/2026:15:42:59 +0000] "GET /.dockerenv HTTP/2.0" 404 1448 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.143.149.232 - - [17/Sep/2026:15:42:59 +0000] "GET /.env.local?import&raw HTTP/2.0" 404 1452 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
34.143.149.232 - - [17/Sep/2026:15:42:59 +0000] "GET /.env.local?import&raw HTTP/2.0" 404 1452 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
34.143.149.232 - - [17/Sep/2026:15:42:59 +0000] "GET /.env.local?raw HTTP/2.0" 404 1451 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.143.149.232 - - [17/Sep/2026:15:42:59 +0000] "GET /.env.local?raw HTTP/2.0" 404 1451 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.143.149.232 - - [17/Sep/2026:15:43:00 +0000] "GET /.env.p
...
show less
Port Scan
Web App Attack
🇩🇪
raph
2026-09-17 14:18:27
(1 day ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇬🇧
Marten Mark
2026-09-17 12:57:00
(1 day ago)
34.143.149.232 - - [17/Sep/2026:12:56:56 +0000] "GET /build/manifest.json HTTP/2.0" 404 5335 "-" "Mo ...
show more
34.143.149.232 - - [17/Sep/2026:12:56:56 +0000] "GET /build/manifest.json HTTP/2.0" 404 5335 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36"
34.143.149.232 - - [17/Sep/2026:12:56:56 +0000] "GET /dist/.vite/manifest.json HTTP/2.0" 404 5335 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36"
34.143.149.232 - - [17/Sep/2026:12:56:56 +0000] "GET /dist/manifest.json HTTP/2.0" 404 5335 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36"
34.143.149.232 - - [17/Sep/2026:12:56:56 +0000] "GET /z9x8c7v6b5-debug-trigger-blog.cfi.co HTTP/2.0" 404 5335 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)"
34.143.149.232 - - [17/Sep/2026:12:56:56 +0000] "GET /.vite/manifest.json HTTP/2.0" 404 5335 "-" "Mozilla/5.0 (Linux; Android
...
show less
Port Scan
Web App Attack
🇿🇦
conure.sh
2026-09-17 12:11:28
(1 day ago)
csagent: score 21.2: 404 noise floor x7, secrets grab x2; 1 domain(s) in 24s
Web App Attack
🇧🇷
dermatovirtual
2026-09-17 11:35:29
(1 day ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 45 unauthorized requests recorded between 2026-09-17 09:35:36 UTC and 2026-09-17 09:35:47 UTC (rate: ~45 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-09-17 09:35:43 UTC] IP: 34.143.149.232 - W3C IIS (Port 443): GET /temp/.env -> HTTP 404 [CLIENT: 34.143.149.232]
[2026-09-17 09:35:43 UTC] IP: 34.143.149.232 - W3C IIS (Port 443): GET /var/.env -> HTTP 404 [CLIENT: 34.143.149.232]
[2026-09-17 09:35:43 UTC] IP: 34.143.149.232 - W3C IIS (Port 443): GET /env/.env -> HTTP 404 [CLIENT: 34.143.149.232]
show less
Bad Web Bot
Web App Attack
🇩🇪
webanyone
2026-09-17 10:01:41
(1 day ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇳🇱
e.fierstra
2026-09-17 09:49:31
(1 day ago)
excessive HTTP 404 errors
Bad Web Bot
🇮🇳
evicky2002
2026-09-17 06:00:05
(1 day ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇬🇧
noise.agency
2026-09-17 05:48:42
(1 day ago)
34.143.149.232 (SG/Singapore/232.149.143.34.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
🇸🇬
Cloudkul Cloudkul
2026-09-17 05:42:49
(1 day ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
2026-09-17 05:38:31
(1 day ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack