🇬🇧
openstrike.co.uk
2026-10-09 05:14:56
(3 days ago)
147 attacks on password/key grabbing URLs, env grabbing URLs (type 2), shell probes, env grabbing UR ...
show more
147 attacks on password/key grabbing URLs, env grabbing URLs (type 2), shell probes, env grabbing URLs, config grabbing URLs (type 2), VC URLs, directory traversals, PHP URLs:
GET /.git-credentials HTTP/1.1
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /media../.env HTTP/1.1
GET /secrets.yml HTTP/1.1
GET /.git/config HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
2026-10-09 04:26:09
(3 days ago)
malicious scanning tool activity
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 02:45:30
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:45:25.834213 2026] [security2:error] [pid 32739:tid 32739] [client 34.182.255.219:52520] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thinksite.net"] [uri "/.env"] [unique_id "ashVRfMxX3y5HGb3tCmRrQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 02:17:55
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 22:17:52.374407 2026] [security2:error] [pid 16216:tid 16216] [client 34.182.255.219:36400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thepinesokc.org"] [uri "/.htpasswd"] [unique_id "ashO0Bs_MLyj5kdaBQu9UwAAAC0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
johntps
2026-10-09 02:05:40
(3 days ago)
Automated honeypot defense: host probed a decoy/trap endpoint (/settings.json) on a monitored web se ...
show more
Automated honeypot defense: host probed a decoy/trap endpoint (/settings.json) on a monitored web server; confirmed malicious and blocked.
show less
Web App Attack
Bad Web Bot
🇬🇧
NotCool
2026-10-09 01:58:11
(3 days ago)
(CRAWLDELAY) Generic Bot Crawl-delay Violation 34.182.255.219 (US/United States/219.255.182.34.bc.go ...
show more
(CRAWLDELAY) Generic Bot Crawl-delay Violation 34.182.255.219 (US/United States/219.255.182.34.bc.googleusercontent.com): 50 in the last 3600 secs
show less
Bad Web Bot
🇨🇦
Anytech
2026-10-09 01:55:02
(3 days ago)
Blocked by ConnMonitor: Bad Bot
Bad Web Bot
Spoofing
🇫🇷
✨
2026-10-09 01:50:18
(3 days ago)
Domain : theoutposts.com
Rule : admin
2026-10-09 01:48:30 ***hidden-privacy*** GET /admin/login - 44 ...
show more
Domain : theoutposts.com
Rule : admin
2026-10-09 01:48:30 ***hidden-privacy*** GET /admin/login - 443 - 34.182.255.219 HTTP/2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 - theoutposts.com 404 0 2 1523 835 116 - -
show less
Hacking
SQL Injection
Brute-Force
🇩🇪
EGP Abuse Dept
2026-10-09 01:40:26
(3 days ago)
Scanning for web/db/file exploits on theorganicgardenroom.nl
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 01:18:20
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:18:16.039066 2026] [security2:error] [pid 5031:tid 5031] [client 34.182.255.219:52574] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thenutritionfixhollysprings.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thenutritionfixhollysprings.com"] [uri "/z9x8c7v6b5-debug-trigger-thenutritionfixhollysprings.com"] [unique_id "ashA2B1S0UD2SUQsoVjh8QAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-09 01:05:38
(3 days ago)
Scanning/Probing (16)
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-09 01:04:55
(3 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
svr
2026-10-09 00:52:30
(3 days ago)
Abusive Automated Web Scanner
Web App Attack
2026-10-09 00:51:26
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 34.182.255.219 (US/United States/219.25 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.182.255.219 (US/United States/219.255.182.34.bc.googleusercontent.com)
show less
SQL Injection
🇺🇸
TPI-Abuse
2026-10-08 23:53:48
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.182.255.219 (219.255.182.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:53:41.973548 2026] [security2:error] [pid 19048:tid 19048] [client 34.182.255.219:55196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "themarshalls.tv"] [uri "/js../.env"] [unique_id "asgtBUMpUZldQG5twZ2oKwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
