|
🇧🇷
ICS Labs
|
|
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-04 UTC.
|
Brute-Force
|
|
🇩🇪
ghostwarriors
|
|
Attempts against non-existent wp-login
|
Brute-Force
Web App Attack
|
|
🇸🇪
vaia.cloud
|
|
crowdsecurity/http-admin-interface-probing
|
Brute-Force
Web App Attack
|
|
🇩🇪
yitzhaq
|
|
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.git/config HTTP/1.1" 403 512 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "POST ...
show more
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.git/config HTTP/1.1" 403 512 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "POST / HTTP/1.1" 200 1535 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.env HTTP/1.1" 404 509 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.env.local HTTP/1.1" 404 509 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:42 +0100] "GET /.env.production HTTP/1.1" 404 509 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [0
show less
|
Web App Attack
Hacking
|
|
Anonymous
|
|
Bot / scanning and/or hacking attempts: GET /.env.test HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.remote HTTP/1.1
|
Hacking
Web App Attack
|
|
Anonymous
|
|
Web application attack: http sensitive files; Probing for exposed secret / credential files
|
Hacking
Web App Attack
|
|
🇧🇪
cmbplf
|
|
2.335 requests with url.path *.env
313 requests with url.path *phpinfo.php
|
Brute-Force
Bad Web Bot
|
|
Anonymous
|
|
| [Dangerous/South Korea] Aggressive IP 34.64.79.12 (~30 hits). Type: DoS Defender- Web server 400 error code
|
Web App Attack
Hacking
SQL Injection
|
|
🇺🇸
IndigoRidge
|
|
[02/Nov/2026:20:44:33.216894 --0500] auk8geem--PVCZSSuuLJOwAAAM4 34.64.79.12 50414 205.233.18.17 7081
[02/Nov/2026:20:44:34.342330 --0500] auk8guem--PVCZSSuuLJPgAAANM 34.64.79.12 50488 205.233.18.17 7081
[02/Nov/2026:20:44:34.708702 --0500] auk8gmL5h ...
show more
[02/Nov/2026:20:44:33.216894 --0500] auk8geem--PVCZSSuuLJOwAAAM4 34.64.79.12 50414 205.233.18.17 7081
[02/Nov/2026:20:44:34.342330 --0500] auk8guem--PVCZSSuuLJPgAAANM 34.64.79.12 50488 205.233.18.17 7081
[02/Nov/2026:20:44:34.708702 --0500] auk8gmL5hL7tNEdOqO6-HQAAAFU 34.64.79.12 50516 205.233.18.17 7081
[02/Nov/2026:20:44:34.892599 --0500] auk8goSopEbxiC3QlSt6NAAAAJI 34.64.79.12 50518 205.233.18.17 7081
[02/Nov/2026:20:44:35.076204 --0500] auk8g@em--PVCZSSuuLJPwAAAMg 34.64.79.12 50530 205.233.18.17 7081
...
show less
|
Hacking
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:18:59.292259 2026] [security2:error] [pid 24373:tid 2437 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:18:59.292259 2026] [security2:error] [pid 24373:tid 24373] [client 34.64.79.12:44588] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "smartstylehair.com"] [uri "/.git/config"] [unique_id "aui3834CKJoBi9Kh7AKVxwAAAAo"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:45:50.383433 2026] [security2:error] [pid 5390:tid 5390] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:45:50.383433 2026] [security2:error] [pid 5390:tid 5390] [client 34.64.79.12:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.mail-pmg.com"] [uri "/.git/config"] [unique_id "auhNvp83M2AWXbMIBrSWUgAAAAg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇮🇹
VHosting
|
|
Detected WordPress attack from different servers
|
Brute-Force
Web App Attack
|