🇳🇱
Site.eu
2026-10-16 02:00:41
(6 days ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
openstrike.co.uk
2026-10-14 05:14:25
(1 week ago)
226 attacks on env grabbing URLs (type 2), shell probes, PHP URLs, password/key grabbing URLs, env g ...
show more
226 attacks on env grabbing URLs (type 2), shell probes, PHP URLs, password/key grabbing URLs, env grabbing URLs, config grabbing URLs (type 2), directory traversals, VC URLs:
GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
GET /.env.supabase HTTP/1.1
GET /config/settings.local.yml HTTP/1.1
GET /..%2f.env HTTP/1.1
GET /.git/HEAD HTTP/1.1
show less
Hacking
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-14 01:46:32
(1 week ago)
(mod_security) mod_security (id:949110) triggered by 34.39.179.225 (BR/Brazil/225.179.39.34.bc.googl ...
show more
(mod_security) mod_security (id:949110) triggered by 34.39.179.225 (BR/Brazil/225.179.39.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇩🇪
FeG Deutschland
2026-10-14 01:21:43
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 128
Exploited Host
Web App Attack
🇩🇪
FeG Deutschland
2026-10-13 17:05:51
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1248
Exploited Host
Web App Attack
🇺🇸
iwle
2026-10-13 16:34:09
(1 week ago)
[Tue Oct 13 12:34:07.981493 2026] [:error] [pid 1681512:tid 1681556] [client 34.39.179.225:0] [clien ...
show more
[Tue Oct 13 12:34:07.981493 2026] [:error] [pid 1681512:tid 1681556] [client 34.39.179.225:0] [client 34.39.179.225] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "uvscards.com"] [uri "/static../.env"] [unique_id "as5df2TX3420dHEOPwz-1gAAANA"]
[Tue Oct 13 12:34:07.988339 2026] [:error] [pid 1681308:tid 1681391] [client 34.39.179.225:0] [client 34.39.179.225] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [l
...
show less
Web App Attack
🇳🇱
middelkoopcc
2026-10-13 14:20:11
(1 week ago)
2026-10-13 16:18:18 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/enviro ...
show more
2026-10-13 16:18:18 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ) && 2026-10-13 16:18:18 AH10244: invalid URI path (/%2e%2e/.env) && 2026-10-13 16:18:19 AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ) && 231 more within 20 minutes
show less
Web App Attack
🇳🇱
Site.eu
2026-10-13 13:37:55
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
e.fierstra
2026-10-13 13:23:58
(1 week ago)
excessive HTTP 404 errors
Bad Web Bot
🇳🇱
Alt255
2026-10-13 12:19:18
(1 week ago)
[ti-05al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ...
show more
[ti-05al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.39.179.225 - - [13/Oct/2026:14:19:10 +0200] "GET /th63722av0vg63p6z355 HTTP/2.0" 404 1878 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.39.179.225 - - [13/Oct/2026:14:19:10 +0200] "GET /7vnko543ss8ddczt4tic HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.39.179.225 - - [13/Oct/2026:14:19:11 +0200] "GET /secrets.env HTTP/2.0" 404 1878 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.39.179.225 - - [13/Oct/2026:14:19:11 +0200] "GET /key.json HTTP/2.0" 404 1855 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.39.179.225 - - [13/Oct/2
...
show less
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-10-13 12:17:29
(1 week ago)
.env scanning [BY]
Web App Attack
🇬🇧
venus.launch.bz
2026-10-13 12:13:33
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted] 34.39.179.225 (BR/Brazil/225.179.39.34. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.39.179.225 (BR/Brazil/225.179.39.34.bc.googleusercontent.com)
show less
SQL Injection
🇲🇾
Rizzy
2026-10-13 12:00:48
(1 week ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 11:58:07
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.39.179.225 (225.179.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.179.225 (225.179.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:57:59.436571 2026] [security2:error] [pid 22008:tid 22008] [client 34.39.179.225:59674] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||banis-associates.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "banis-associates.com"] [uri "/z9x8c7v6b5-debug-trigger-banis-associates.com"] [unique_id "as4cx-TrJrhmp683XTQ5MgAAAFI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
renzo64
2026-10-13 11:24:11
(1 week ago)
Domain : conference-biomass.com
Rule : hack
2026-10-13 11:22:24 ***hidden-privacy*** GET /z9x8c7v6b5 ...
show more
Domain : conference-biomass.com
Rule : hack
2026-10-13 11:22:24 ***hidden-privacy*** GET /z9x8c7v6b5-debug-trigger-conference-biomass.com - 443 - 34.39.179.225 HTTP/2 Mozilla/5.0 (compatible; Bravebot/1.0; https://brave.com/search/) - conference-biomass.com 301 0 0 330 434 289 - -
show less
Hacking
SQL Injection
Brute-Force