๐ฉ๐ช
IVski.com
2026-10-14 01:08:01
(2 days ago)
IVski WAF | Webshell probe detected - requesting common script extensions
Hacking
Brute-Force
Web App Attack
๐ธ๐ช
Per-Erik Runebert
2026-10-13 08:39:24
(3 days ago)
Excessive unauthorized requests
Hacking
๐ฌ๐ง
openstrike.co.uk
2026-10-13 05:16:00
(3 days ago)
252 attacks on shell probes, env grabbing URLs (type 2), password/key grabbing URLs, VC URLs, PHP UR ...
show more
252 attacks on shell probes, env grabbing URLs (type 2), password/key grabbing URLs, VC URLs, PHP URLs, config grabbing URLs (type 2), env grabbing URLs, directory traversals:
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /?allowOutsideWorkspace=true&path=/proc/self/environ HTTP/1.1
GET /?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1
GET /config/gcp-credentials.json HTTP/1.1
GET /?filename=file:///app/.env&environmentName=rsc HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
show less
Hacking
Web App Attack
๐ฉ๐ช
Skyrider
2026-10-12 23:59:16
(3 days ago)
crowdsecurity/http-probing
Web App Attack
๐บ๐ธ
ALSCOยฎ๏ธ
2026-10-12 22:00:18
(3 days ago)
Report By ALSCO Security Team: Unauthorized Connection Attempt
SQL Injection
๐บ๐ธ
Secure Gatewayยฎ๏ธ
2026-10-12 22:00:17
(3 days ago)
Report By Secure Gateway Security Team: Suspicious File Upload Attempt
SQL Injection
Anonymous
2026-10-12 19:39:26
(3 days ago)
34.169.29.160 - - [12/Oct/2026:14:39:25 -0500] "GET /.env.credentials HTTP/1.1" 403 199 "-" "Mozilla ...
show more
34.169.29.160 - - [12/Oct/2026:14:39:25 -0500] "GET /.env.credentials HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)" 34.169.29.160
34.169.29.160 - - [12/Oct/2026:14:39:25 -0500] "GET /.env.secret HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot" 34.169.29.160
34.169.29.160 - - [12/Oct/2026:14:39:25 -0500] "GET /.env.keys HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" 34.169.29.160
34.169.29.160 - - [12/Oct/2026:14:39:25 -0500] "GET /.env.dev.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" 34.169.29.160
34.169.29.160 - - [12/Oct/2026:14:39:25 -0500] "GET /.env.config HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.169.29.160
34.169.29.160 - - [12/Oct/2026:14:39:25 -0500] "GE
...
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-12 19:10:09
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 34.169.29.160 (160.29.169.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.169.29.160 (160.29.169.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 15:10:05.545762 2026] [security2:error] [pid 31239:tid 31239] [client 34.169.29.160:43490] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||z-mgmt.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "z-mgmt.com"] [uri "/z9x8c7v6b5-debug-trigger-z-mgmt.com"] [unique_id "as0wjdDCvQVXDKzUWEp-IwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
LRob
2026-10-12 18:58:24
(3 days ago)
Crawler ignoring refusals | ua: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claud ...
show more
Crawler ignoring refusals | ua: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] ), Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0, Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/) (+11 more) | path: /iqckpi7oxu7f49xg9o7l, /assets/manifest.json, /lib/terminal-xhr.php (+16 more)
show less
Bad Web Bot
๐บ๐ธ
Mundo Bueno
2026-10-12 18:36:04
(3 days ago)
[ISILIA Protection v2.3] Tentative d'accรจs: /packages/.env [RATE LIMITED - 1800s quarantine] | Pays: ...
show more
[ISILIA Protection v2.3] Tentative d'accรจs: /packages/.env [RATE LIMITED - 1800s quarantine] | Pays: US | UA: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)
show less
Hacking
Web App Attack
๐ซ๐ท
[email protected]
2026-10-12 18:23:57
(3 days ago)
PrestaShop Security Module: suspicious probe path detected (/.env)
Web App Attack
๐ฉ๐ช
findlab
2026-10-12 18:20:01
(3 days ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
๐ช๐ธ
robotstxt
2026-10-12 18:02:40
(3 days ago)
34.169.29.160 - - [12/Oct/2026:18:01:42 +0000] "GET /.vite/manifest.json HTTP/1.1" 403 28011 "https: ...
show more
34.169.29.160 - - [12/Oct/2026:18:01:42 +0000] "GET /.vite/manifest.json HTTP/1.1" 403 28011 "https://segurodevidayfamilia.es/.vite/manifest.json" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36" "34.169.29.160"
34.169.29.160 - - [12/Oct/2026:18:01:43 +0000] "GET /.env.development?raw HTTP/1.1" 403 0 "https://segurodevidayfamilia.es/.env.development?raw" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" "34.169.29.160"
34.169.29.160 - - [12/Oct/2026:18:01:43 +0000] "GET /.env.supabase HTTP/1.1" 403 0 "https://segurodevidayfamilia.es/.env.supabase" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "34.169.29.160"
34.169.29.160 - - [12/Oct/2026:18:01:47 +0000] "GET /.env.ses HTTP/1.1" 403 28011 "https://segurodevidayfamilia.es/.env.ses" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://o
...
show less
Web App Attack
๐ต๐ฑ
sefinek.net
2026-10-12 17:58:19
(3 days ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/2 (POST) | Endpoin ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/2 (POST) | Endpoint: /exec-py | UA: Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) โข Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
๐ณ๐ฟ
realstuffie
2026-10-12 17:46:49
(3 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking