🇬🇧
openstrike.co.uk
2026-11-07 06:16:39
UTC ·
(2 days ago)
8 attacks on site downloads (type 2), VC URLs, password/key grabbing URLs, config grabbing URLs (type 2):
GET /v2/ HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /.aws/credentials HTTP/1.1
GET /config/firebase-adminsdk.json HTTP/1.1
Hacking
🇱🇻
radix
2026-11-07 00:19:04
UTC ·
(2 days ago)
Automated probing for sensitive configuration files and environment leaks.
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-06 22:59:49
UTC ·
(3 days ago)
Auto-ban: >3000 req/min op 2026-11-06
Web App Attack
SSH
Hacking
🇫🇷
mail.avx.gr
2026-11-06 20:04:31
UTC ·
(3 days ago)
plesk-rapid-ban sensitive-file-probe host=zax.deya.paladin.gr
Hacking
🇺🇸
TPI-Abuse
2026-11-06 19:16:23
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.178.19.0 (0.19.178.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:16:17.273033 2026] [security2:error] [pid 3411:tid 3411] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.178.19.0 (0.19.178.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:16:17.273033 2026] [security2:error] [pid 3411:tid 3411] [client 34.178.19.0:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.blog.nyemdr.com"] [uri "/.git/HEAD"] [unique_id "au4ngdDhNVDGQtwjLfZ2ZAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-11-06 16:57:50
UTC ·
(3 days ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): Abuse 100 / BAN. IP is on the AbuseIPDB blacklist and was blocked on the first request.
Hacking
Exploited Host
Web App Attack
🇧🇷
radardatelecom
2026-11-06 16:54:03
UTC ·
(3 days ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-06 16:04:45
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: cdn.teddypot.pro | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: cdn.teddypot.pro | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-06 12:34:37
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: git.budyn.top | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: git.budyn.top | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-06 12:34:21
UTC ·
(3 days ago)
Try to access /.env
Web App Attack
🇬🇧
openstrike.co.uk
2026-11-06 06:15:58
UTC ·
(3 days ago)
2 attacks on VC URLs:
GET /.git/HEAD HTTP/1.1
Hacking
🇺🇸
TPI-Abuse
2026-11-06 06:04:35
UTC ·
(3 days ago)
(mod_security) mod_security (id:248270) triggered by 34.178.19.0 (0.19.178.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:04:31.875878 2026] [security2:error] [pid 29734:tid 2973 ...
show more
(mod_security) mod_security (id:248270) triggered by 34.178.19.0 (0.19.178.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:04:31.875878 2026] [security2:error] [pid 29734:tid 29734] [client 34.178.19.0:38316] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||hazelwerner.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "hazelwerner.com"] [uri "/"] [unique_id "au1t74Gos9ztw7rHK_UO1gAAAAw"], referer: ${jndi:ldap://127.0.0.1/bifrost-probe}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-06 05:11:06
UTC ·
(3 days ago)
[ti-29al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.178.19.0 - - [06/Nov/2026:06:10:58 +0100] "GET /.env HTTP/1.1" 301 6383 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT ...
show more
[ti-29al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.178.19.0 - - [06/Nov/2026:06:10:58 +0100] "GET /.env HTTP/1.1" 301 6383 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
WellSpring
2026-11-06 04:54:45
UTC ·
(3 days ago)
git exposure on wellspr.ing/.git/info/refs — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack
🇩🇪
FD-IX
2026-11-06 04:50:50
UTC ·
(3 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
