|
🇫🇷
SpaceHost-Server
|
|
|
Brute-Force
Web App Attack
|
|
🇧🇷
ICS Labs
|
|
ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-11-05 UTC.
|
Brute-Force
Exploited Host
|
|
🇦🇺
mjmouse
|
|
made 529 requests and visited honeypot only listed in robots.txt
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /[honeypot]/ HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /.vscode/launch.json HTTP/1.1" 403
34.152.30.44 - - [ ...
show more
made 529 requests and visited honeypot only listed in robots.txt
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /[honeypot]/ HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /.vscode/launch.json HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /config/settings.local.yml HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /docker-compose.prod.yml HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /Dockerrun.aws.json HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /.docker/secrets.json HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /docker-compose.staging.yml HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /[honeypot]/ab-1/ HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /docker-compose.override.yml HTTP/1.1" 403
34.152.30.44 - - [05/Nov/2026:09:19:53 +0000] "GET /docker-compose.dev.yml HTTP/1.1" 403
show less
|
Bad Web Bot
Web App Attack
Hacking
|
|
🇺🇸
Blue Pumpkin
|
|
34.152.30.44 - - [05/Nov/2026:08:55:22 +0000] "GET /sitemap_index.xml HTTP/1.1" 403 24350 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googleb ...
show more
34.152.30.44 - - [05/Nov/2026:08:55:22 +0000] "GET /sitemap_index.xml HTTP/1.1" 403 24350 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
|
Brute-Force
|
|
🇸🇪
vaia.cloud
|
|
crowdsecurity/http-cve-2021-41773
|
Brute-Force
Web App Attack
|
|
🇩🇪
gadix
|
|
[05/Nov/2026:08:34:21.082154 +0100] auwxfSotyVwEeYDcZ_J2IgAAAFg 34.152.30.44 33978 127.0.0.1 7081
[05/Nov/2026:08:34:21.121862 +0100] auwxfVPB-VQ-b5zKHT4JCQAAAAg 34.152.30.44 34004 127.0.0.1 7081
[05/
...
|
Web App Attack
|
|
🇺🇸
Blue Pumpkin
|
|
34.152.30.44 - - [05/Nov/2026:07:30:00 +0000] "GET /docker-compose.yaml HTTP/1.1" 302 601 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
|
Brute-Force
|
|
🇬🇧
openstrike.co.uk
|
|
210 attacks on VC URLs, password/key grabbing URLs, env grabbing URLs, directory traversals, config grabbing URLs (type 2), PHP URLs, env grabbing URLs (type 2):
GET /.git/HEAD HTTP/1.1
GET /.git-credentials HTTP/1.1
GET /.next/.env HTTP/1.1
GET /..% ...
show more
210 attacks on VC URLs, password/key grabbing URLs, env grabbing URLs, directory traversals, config grabbing URLs (type 2), PHP URLs, env grabbing URLs (type 2):
GET /.git/HEAD HTTP/1.1
GET /.git-credentials HTTP/1.1
GET /.next/.env HTTP/1.1
GET /..%2f.env HTTP/1.1
GET /secrets.json HTTP/1.1
GET /laravel../config/database.php HTTP/1.1
GET /proc/self/environ HTTP/1.1
show less
|
Hacking
Web App Attack
|
|
🇨🇦
CentiDevOps
|
|
Web app scan: 63 requests in 0 s across 2 domains (301/302/404/444). Paths: /.//.env, //.env, /api/.env/public/.env (+17 more). Sample: 2026-11-05T04:40:47Z "GET /static//.env" 301
|
Hacking
Web App Attack
|
|
🇳🇱
Alt255
|
|
[ti-10al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.152.30.44 - - [05/Nov/2026:04:48:21 +0100] "GET /settings/integrations HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Macintosh; Intel Mac O ...
show more
[ti-10al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.152.30.44 - - [05/Nov/2026:04:48:21 +0100] "GET /settings/integrations HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.152.30.44 - - [05/Nov/2026:04:48:21 +0100] "GET /settings/team HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.152.30.44 - - [05/Nov/2026:04:48:21 +0100] "GET /debug HTTP/2.0" 404 1854 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.152.30.44 - - [05/Nov/2026:04:48:21 +0100] "GET /settings/developer HTTP/2.0" 404
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇫🇷
SpaceHost-Server
|
|
|
Brute-Force
Web App Attack
|
|
🇺🇸
mnsf
|
|
Too many Status 40X (14)
Scanning/Probing (13)
|
Brute-Force
Web App Attack
|
|
🇺🇸
brightenfield
|
|
Web App Attack
|
Web App Attack
|
|
🇫🇷
masterguru
|
|
BAD BOT - Detected and Blocked.. Matched phrase "baidu" at REQUEST_HEADERS:User-Agent. (1100000-193)
|
Bad Web Bot
|
|
🇳🇱
Alt255
|
|
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.152.30.44 - - [04/Nov/2026:23:05:10 +0100] "GET /img../.env HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.dee ...
show more
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.152.30.44 - - [04/Nov/2026:23:05:10 +0100] "GET /img../.env HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
...
show less
|
Bad Web Bot
Web App Attack
|