🇬🇧
openstrike.co.uk
2026-10-10 05:14:05
(3 days ago)
115 attacks on env grabbing URLs (type 2), config grabbing URLs (type 2), directory traversals, shel ...
show more
115 attacks on env grabbing URLs (type 2), config grabbing URLs (type 2), directory traversals, shell probes, PHP URLs, password/key grabbing URLs, env grabbing URLs:
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /app-config.json HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/1.1
GET /userfiles/x?path=../../.env HTTP/1.1
show less
Hacking
Web App Attack
🇧🇷
radardatelecom
2026-10-09 22:27:04
(3 days ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-09 21:59:56
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-08.
show less
Web App Attack
SSH
Hacking
🇬🇧
openstrike.co.uk
2026-10-09 05:15:12
(4 days ago)
147 attacks on directory traversals, PHP URLs, VC URLs, config grabbing URLs (type 2), env grabbing ...
show more
147 attacks on directory traversals, PHP URLs, VC URLs, config grabbing URLs (type 2), env grabbing URLs, shell probes, env grabbing URLs (type 2), password/key grabbing URLs:
GET /..%2f..%2f.env HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /config/firebase-admin.json HTTP/1.1
GET /server/.env HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ HTTP/1.1
GET /.git-credentials HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
Hazzard
2026-10-09 05:05:27
(4 days ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇩🇪
Gwyneth Llewelyn
2026-10-09 04:50:34
(4 days ago)
2026/10/09 05:50:26 [error] 4060693#4060693: *1414870 access forbidden by rule, client: 34.187.77.12 ...
show more
2026/10/09 05:50:26 [error] 4060693#4060693: *1414870 access forbidden by rule, client: 34.187.77.128, server: vp-arc.org, request: "GET /cache/original/%2e%2e/.env HTTP/2.0", host: "vp-arc.org"
2026/10/09 05:50:26 [error] 4060693#4060693: *1414870 access forbidden by rule, client: 34.187.77.128, server: vp-arc.org, request: "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/2.0", host: "vp-arc.org"
2026/10/09 05:50:32 [error] 4060693#4060693: *1414870 access forbidden by rule, client: 34.187.77.128, server: vp-arc.org, request: "GET /.env HTTP/2.0", host: "vp-arc.org"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 04:41:24
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 34.187.77.128 (128.77.187.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.187.77.128 (128.77.187.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 00:41:17.153345 2026] [security2:error] [pid 17161:tid 17161] [client 34.187.77.128:44214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tracybur.net"] [uri "/.htpasswd"] [unique_id "ashwbeEYfjaRjXXr9rmZ3gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇰
HostingGroup
2026-10-09 04:31:52
(4 days ago)
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shiel ...
show more
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 5. First blocked: 2026-10-09.
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-09 04:25:31
(4 days ago)
[ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 34. ...
show more
[ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 34.187.77.128 - - \[09/Oct/2026:06:25:22 +0200\] "GET /.ssh/id_ed25519 HTTP/1.1" 301 533 "-" "Mozilla/5.0 \(compatible\; Qwenbot/1.0\; +https://qwen.alibaba.com/\)"
34.187.77.128 - - \[09/Oct/2026:06:25:22 +0200\] "GET /.htpasswd HTTP/1.1" 301 521 "-" "CCBot/2.0 \(https://commoncrawl.org/faq/\)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 04:14:28
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 34.187.77.128 (128.77.187.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.187.77.128 (128.77.187.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 00:14:21.698060 2026] [security2:error] [pid 27423:tid 27423] [client 34.187.77.128:32994] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||smogsandiego.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "smogsandiego.com"] [uri "/z9x8c7v6b5-debug-trigger-smogsandiego.com"] [unique_id "ashqHRjg-gesWxgrzDwY_wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-10-09 04:14:28
(4 days ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇨🇭
YF
2026-10-09 04:07:17
(4 days ago)
Distributed subnet attack — coordinated scanning from multiple IPs in the same /24
DDoS Attack
Web App Attack
🇩🇪
ghostwarriors
2026-10-09 03:50:06
(4 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
netman
2026-10-09 03:34:15
(4 days ago)
34.187.77.128 smartonlinepayment.com - [09/Oct/2026:03:33:57 +0000] "GET / HTTP/2.0" 200 217859 "-" ...
show more
34.187.77.128 smartonlinepayment.com - [09/Oct/2026:03:33:57 +0000] "GET / HTTP/2.0" 200 217859 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
34.187.77.128 smartonlinepayment.com - [09/Oct/2026:03:33:58 +0000] "GET /asset-manifest.json HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
34.187.77.128 smartonlinepayment.com - [09/Oct/2026:03:33:58 +0000] "GET /manifest.json HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
34.187.77.128 smartonlinepayment.com - [09/Oct/2026:03:33:58 +0000] "GET /static/manifest.json HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
34.187.77.128 smartonlinepayment.com - [09/Oct/2026:03:33:58 +0000] "GET /dist/manifest.json HTTP/2.0
...
show less
DDoS Attack
Web App Attack
2026-10-09 03:30:04
(4 days ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
