🇧🇷
ICS Labs
2026-11-11 17:17:06
UTC ·
(18 hours ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-11 UTC.
Brute-Force
🇨🇦
dbgroupe
2026-11-11 07:29:03
UTC ·
(1 day ago)
11/Nov/2026:02:29:01.943595Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client 34.175.146.213] ModSecurity: Warning. Pattern match "(?:\\\\\\\\$(?:\\\\\\\\((?:\\\\\\\\(.*\\\\\\\\)|.*)\\\\\\\\)|\\\\\\\\{.*\\\\\\\\})|[<>]\\\\\\\\(.*\\\\\ ...
show more
11/Nov/2026:02:29:01.943595Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client 34.175.146.213] ModSecurity: Warning. Pattern match "(?:\\\\\\\\$(?:\\\\\\\\((?:\\\\\\\\(.*\\\\\\\\)|.*)\\\\\\\\)|\\\\\\\\{.*\\\\\\\\})|[<>]\\\\\\\\(.*\\\\\\\\))" at ARGS:0. [file "/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [t
...
show less
Bad Web Bot
Web App Attack
🇺🇸
conrad10781
2026-11-11 06:59:14
UTC ·
(1 day ago)
nginx-dot-env
Web App Attack
🇩🇪
ghostwarriors
2026-11-11 04:20:04
UTC ·
(1 day ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇳🇱
i-turnradio.nl
2026-11-11 03:59:18
UTC ·
(1 day ago)
2026-11-11 @ 04:59:06 (CET) ~ Blocked for trying to access: /.env.local
Web App Attack
🇳🇱
Alt255
2026-11-11 03:56:04
UTC ·
(1 day ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.175.146.213 - - [11/Nov/2026:04:55:54 +0100] "GET /.git/config HTTP/1.1" 403 179 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.175.146.213 - - [11/Nov/2026:04:55:54 +0100] "GET /.git/config HTTP/1.1" 403 179 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
throny
2026-11-11 03:50:13
UTC ·
(1 day ago)
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome ...
show more
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.
Requested, e.g.:
- db.[REDACTED]/
show less
Bad Web Bot
🇵🇱
Budyn
2026-11-11 03:12:24
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: db.astropot.site | Path: /.env.dev | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: db.astropot.site | Path: /.env.dev | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
kosada.com
2026-11-11 01:19:40
UTC ·
(1 day ago)
Repeated exploit attempts, for example: / {x22thenx22: x22$1:__proto__:thenx22, x22statusx22: x22resolved_modelx22, x22reasonx22: -1, x22valuex22: x22{x5cx22thenx5cx22:x5cx22$B1337x5cx22}x22 (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (X11; Linux x8 ...
show more
Repeated exploit attempts, for example: / {x22thenx22: x22$1:__proto__:thenx22, x22statusx22: x22resolved_modelx22, x22reasonx22: -1, x22valuex22: x22{x5cx22thenx5cx22:x5cx22$B1337x5cx22}x22 (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36")
show less
Web App Attack
🇫🇷
masterguru
2026-11-10 19:41:01
UTC ·
(1 day ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇬🇧
consul.to
2026-11-10 18:45:46
UTC ·
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇨🇦
CentiDevOps
2026-11-10 18:00:10
UTC ·
(1 day ago)
Web app scan: 23 requests in 50 min across 3 domains (301). Paths: /.git/config, /.env, /.env.local (+1 more). Sample: 2026-11-10T18:00:10Z "GET /.git/config" 301
Hacking
Web App Attack
🇮🇹
VHosting
2026-11-10 03:55:04
UTC ·
(2 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-11-09 00:31:54
UTC ·
(3 days ago)
2026-11-09 01:31:52,085 fail2ban.actions [640]: NOTICE [apache-noscript] Ban 34.175.146.213
2026-11-09 01:31:52,173 fail2ban.actions [640]: NOTICE [apache-custom] Ban 34.175.146.213
2026-11-09 01:31:52,595 fail2ban.actions [640 ...
show more
2026-11-09 01:31:52,085 fail2ban.actions [640]: NOTICE [apache-noscript] Ban 34.175.146.213
2026-11-09 01:31:52,173 fail2ban.actions [640]: NOTICE [apache-custom] Ban 34.175.146.213
2026-11-09 01:31:52,595 fail2ban.actions [640]: NOTICE [apache-php-scans] Ban 34.175.146.213
...
show less
Brute-Force
Web App Attack
🇩🇪
altenglaner
2026-11-08 20:19:45
UTC ·
(3 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
