🇧🇷
ICS Labs
2026-11-04 14:36:29
UTC ·
(4 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-04 UTC.
Brute-Force
🇩🇪
ghostwarriors
2026-11-04 00:20:21
UTC ·
(5 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇸🇪
vaia.cloud
2026-11-04 00:15:02
UTC ·
(5 days ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-04 00:08:46
UTC ·
(5 days ago)
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.git/config HTTP/1.1" 403 512 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "POST ...
show more
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.git/config HTTP/1.1" 403 512 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "POST / HTTP/1.1" 200 1535 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.env HTTP/1.1" 404 509 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:41 +0100] "GET /.env.local HTTP/1.1" 404 509 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [04/Nov/2026:01:08:42 +0100] "GET /.env.production HTTP/1.1" 404 509 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.64.79.12 - - [0
show less
Web App Attack
Hacking
Anonymous
2026-11-03 23:37:05
UTC ·
(5 days ago)
Bot / scanning and/or hacking attempts: GET /.env.test HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.remote HTTP/1.1
Hacking
Web App Attack
Anonymous
2026-11-03 23:06:29
UTC ·
(5 days ago)
Web application attack: http sensitive files; Probing for exposed secret / credential files
Hacking
Web App Attack
🇧🇪
cmbplf
2026-11-03 06:24:57
UTC ·
(6 days ago)
2.335 requests with url.path *.env
313 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot
Anonymous
2026-11-03 04:40:16
UTC ·
(6 days ago)
| [Dangerous/South Korea] Aggressive IP 34.64.79.12 (~30 hits). Type: DoS Defender- Web server 400 error code
Web App Attack
Hacking
SQL Injection
🇺🇸
IndigoRidge
2026-11-03 01:44:35
UTC ·
(6 days ago)
[02/Nov/2026:20:44:33.216894 --0500] auk8geem--PVCZSSuuLJOwAAAM4 34.64.79.12 50414 205.233.18.17 7081
[02/Nov/2026:20:44:34.342330 --0500] auk8guem--PVCZSSuuLJPgAAANM 34.64.79.12 50488 205.233.18.17 7081
[02/Nov/2026:20:44:34.708702 --0500] auk8gmL5h ...
show more
[02/Nov/2026:20:44:33.216894 --0500] auk8geem--PVCZSSuuLJOwAAAM4 34.64.79.12 50414 205.233.18.17 7081
[02/Nov/2026:20:44:34.342330 --0500] auk8guem--PVCZSSuuLJPgAAANM 34.64.79.12 50488 205.233.18.17 7081
[02/Nov/2026:20:44:34.708702 --0500] auk8gmL5hL7tNEdOqO6-HQAAAFU 34.64.79.12 50516 205.233.18.17 7081
[02/Nov/2026:20:44:34.892599 --0500] auk8goSopEbxiC3QlSt6NAAAAJI 34.64.79.12 50518 205.233.18.17 7081
[02/Nov/2026:20:44:35.076204 --0500] auk8g@em--PVCZSSuuLJPwAAAMg 34.64.79.12 50530 205.233.18.17 7081
...
show less
Hacking
🇺🇸
TPI-Abuse
2026-11-02 16:19:06
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:18:59.292259 2026] [security2:error] [pid 24373:tid 2437 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:18:59.292259 2026] [security2:error] [pid 24373:tid 24373] [client 34.64.79.12:44588] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "smartstylehair.com"] [uri "/.git/config"] [unique_id "aui3834CKJoBi9Kh7AKVxwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 08:45:56
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:45:50.383433 2026] [security2:error] [pid 5390:tid 5390] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.64.79.12 (12.79.64.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:45:50.383433 2026] [security2:error] [pid 5390:tid 5390] [client 34.64.79.12:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.mail-pmg.com"] [uri "/.git/config"] [unique_id "auhNvp83M2AWXbMIBrSWUgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-11-02 08:45:06
UTC ·
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack