Anonymous
2026-10-12 05:31:05
(1 week ago)
34.26.140.133 - - [11/Oct/2026:05:24:37 -0500] "GET /.env HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compat ...
show more
34.26.140.133 - - [11/Oct/2026:05:24:37 -0500] "GET /.env HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" 104.22.1.235
34.26.140.133 - - [11/Oct/2026:05:24:37 -0500] "GET /.env.example HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)" 104.22.1.235
34.26.140.133 - - [11/Oct/2026:05:24:37 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 104.22.1.235
34.26.140.133 - - [11/Oct/2026:05:24:37 -0500] "GET /.env.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" 104.22.1.234
34.26.140.133 - - [11/Oct/2026:05:24:37 -0500] "GET /.env.old HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 104.22.1.235
34.26.140.133 - - [11/Oct/2026:05:24:37 -0500] "GET /.env.bak HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML
...
show less
Brute-Force
Bad Web Bot
Web App Attack
๐จ๐ฆ
polycoda
2026-10-11 11:47:57
(1 week ago)
๐ฅ VERY AGGRESSIVE SCANNER probed over 400 inexistent files and PHP scripts in less than an hour.
Hacking
Web App Attack
Anonymous
2026-10-11 08:30:02
(1 week ago)
CrowdSec decision: crowdsecurity/http-bad-user-agent (origin: crowdsec)
Port Scan
๐ซ๐ท
dusfor72
2026-10-11 03:24:04
(1 week ago)
stupid access attempts on non-existant files
...
Web App Attack
๐ฉ๐ช
Gwyneth Llewelyn
2026-10-11 03:04:59
(1 week ago)
2026/10/11 04:04:45 [error] 4060693#4060693: *2034826 access forbidden by rule, client: 34.26.140.13 ...
show more
2026/10/11 04:04:45 [error] 4060693#4060693: *2034826 access forbidden by rule, client: 34.26.140.133, server: zonadetestes.com, request: "GET /cache/original/%2e%2e/.env HTTP/2.0", host: "zonadetestes.com"
2026/10/11 04:04:46 [error] 4060693#4060693: *2034826 access forbidden by rule, client: 34.26.140.133, server: zonadetestes.com, request: "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/2.0", host: "zonadetestes.com"
2026/10/11 04:04:57 [error] 4060693#4060693: *2034826 access forbidden by rule, client: 34.26.140.133, server: zonadetestes.com, request: "GET /uploads../.env HTTP/2.0", host: "zonadetestes.com"
show less
Brute-Force
Web App Attack
Anonymous
2026-10-11 02:50:04
(1 week ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
๐ณ๐ฑ
Site.eu
2026-10-11 02:48:54
(1 week ago)
Excessive multi-domain requests
Brute-Force
Anonymous
2026-10-11 02:46:00
(1 week ago)
34.26.140.133 - - [11/Oct/2026:04:45:58 +0200] "GET /webpack-stats.json HTTP/1.1" 404 60361
34.26.14 ...
show more
34.26.140.133 - - [11/Oct/2026:04:45:58 +0200] "GET /webpack-stats.json HTTP/1.1" 404 60361
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /static/manifest.json HTTP/1.1" 404 65202
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /dist/manifest.json HTTP/1.1" 404 65196
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /assets/manifest.json HTTP/1.1" 404 65202
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /asset-manifest.json HTTP/1.1" 404 65198
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /manifest.json HTTP/1.1" 404 65180
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /sa.json HTTP/1.1" 404 60328
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /graphql HTTP/1.1" 404 60328
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /userfiles/x?path=../../../../proc/self/environ?path=..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron HTTP/1.1" 404 61181
34.26.140.133 - - [11/Oct/2026:04:45:59 +0200] "GET /google-credentials.json HTTP/1.1" 404 60376
...
show less
Web Spam
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-11 01:28:26
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.26.140.133 (133.140.26.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.26.140.133 (133.140.26.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:28:18.790114 2026] [security2:error] [pid 9488:tid 9488] [client 34.26.140.133:58030] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||modeltdr.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "modeltdr.com"] [uri "/z9x8c7v6b5-debug-trigger-modeltdr.com"] [unique_id "asrmMrP6ZGp7ChAxwTlaXQAAAGs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
lnklnx
2026-10-11 01:18:05
(1 week ago)
www.lnklnx.com:443 34.26.140.133 - - [10/Oct/2026:20:18:04 -0500] "GET /.env.example HTTP/1.1" 403 4 ...
show more
www.lnklnx.com:443 34.26.140.133 - - [10/Oct/2026:20:18:04 -0500] "GET /.env.example HTTP/1.1" 403 467 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Web App Attack
Anonymous
2026-10-11 01:16:38
(1 week ago)
Web App Attack
๐บ๐ธ
daytonajrw
2026-10-11 01:05:36
(1 week ago)
Path traversal / local file read attempts: 278 requests (GETx275, POSTx3) in 3s (parallel), rotating ...
show more
Path traversal / local file read attempts: 278 requests (GETx275, POSTx3) in 3s (parallel), rotating spoofed crawler User-Agents (Amazonbot, Applebot, Baiduspider, Bytespider), status 200x1, 403x157, 404x120. Exploits attempted: CVE-2025-30208. Also probed: credential/secret files, code-execution exploits, scanner fingerprint paths. Paths incl. /user/login, /@fs/root/.aws/credentials, /@fs/home/ubuntu/.aws/credentials, /@fs/home/ec2-user/.aws/credentials, /@fs/src/.env, /@fs/../.env, /@fs/app/.env, /@fs/var/task/.env
show less
Web App Attack
Bad Web Bot
Hacking
๐ท๐ด
iulianh
2026-10-11 01:02:24
(1 week ago)
80,443
Brute-Force
SSH
๐ฉ๐ช
itsolon
2026-10-11 01:02:13
(1 week ago)
[11/Oct/2026:03:02:13 +0200] 179168053326.222214 34.26.140.133 0 217.154.7.177 443
[11/Oct/2026:03:0 ...
show more
[11/Oct/2026:03:02:13 +0200] 179168053326.222214 34.26.140.133 0 217.154.7.177 443
[11/Oct/2026:03:02:13 +0200] 179168053394.622833 34.26.140.133 0 217.154.7.177 443
[11/Oct/2026:03:02:13 +0200] 179168053378.055046 34.26.140.133 0 217.154.7.177 443
[11/Oct/2026:03:02:13 +0200] 179168053369.793096 34.26.140.133 0 217.154.7.177 443
[11/Oct/2026:03:02:13 +0200] 179168053358.200503 34.26.140.133 0 217.154.7.177 443
...
show less
Port Scan
Hacking
Brute-Force
Web App Attack
๐บ๐ธ
interbiznw.com
2026-10-11 01:00:37
(1 week ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack