🇦🇺
Klaverstyn
2026-11-08 23:09:41
UTC ·
(5 days ago)
Persistent attacker, repeat offender
Hacking
🇦🇺
Klaverstyn
2026-11-06 08:54:27
UTC ·
(1 week ago)
Persistent attacker, repeat offender
Hacking
🇳🇱
homeshowdomain.nl
2026-11-04 23:05:16
UTC ·
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-03.
Web App Attack
SSH
Hacking
🇬🇧
openstrike.co.uk
2026-11-04 06:17:10
UTC ·
(1 week ago)
210 attacks on password/key grabbing URLs, VC URLs, directory traversals, config grabbing URLs (type 2), PHP URLs, env grabbing URLs (type 2), env grabbing URLs:
GET /Dockerrun.aws.json HTTP/1.1
GET /.git/config HTTP/1.1
GET /..%2f.env HTTP/1.1
GET / ...
show more
210 attacks on password/key grabbing URLs, VC URLs, directory traversals, config grabbing URLs (type 2), PHP URLs, env grabbing URLs (type 2), env grabbing URLs:
GET /Dockerrun.aws.json HTTP/1.1
GET /.git/config HTTP/1.1
GET /..%2f.env HTTP/1.1
GET /auth.json HTTP/1.1
GET /config.php.bak HTTP/1.1
GET /api/system/fileView?file=/proc/self/environ HTTP/1.1
GET /.env.supabase HTTP/1.1
show less
Hacking
Web App Attack
🇦🇺
Klaverstyn
2026-11-03 23:46:39
UTC ·
(1 week ago)
Persistent attacker, repeat offender
Hacking
🇧🇷
radardatelecom
2026-11-03 16:53:03
UTC ·
(1 week ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
2026-11-03 16:50:17
UTC ·
(1 week ago)
34.74.200.138 - - [04/Nov/2026:00:50:16 +0800] "GET /sitemap_index.xml HTTP/1.1" 404 30479 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.74.200.138 - - [04/Nov/2026:00:50:16 +0800] ...
show more
34.74.200.138 - - [04/Nov/2026:00:50:16 +0800] "GET /sitemap_index.xml HTTP/1.1" 404 30479 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.74.200.138 - - [04/Nov/2026:00:50:16 +0800] "GET /gxfoflga3chr8uw9d8np HTTP/1.1" 404 30479 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
34.74.200.138 - - [04/Nov/2026:00:50:17 +0800] "GET /ngsw.json HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
34.74.200.138 - - [04/Nov/2026:00:50:17 +0800] "GET /catalog/view/javascript/jquery/ciwhatsapp/ciwhatsapp.js.map HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
34.74.200.138 - - [04/Nov/2026:00:50:17 +0800] "GET /catalog/view/theme/ci_grocery/js/common.js.map HTTP/1.1"
...
show less
Bad Web Bot
Web App Attack
🇫🇮
Ba-Yu
2026-11-03 16:18:06
UTC ·
(1 week ago)
General hacking/exploits/scanning
Port Scan
Exploited Host
Web App Attack
🇲🇾
Rizzy
2026-11-03 15:58:16
UTC ·
(1 week ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-03 14:50:26
UTC ·
(1 week ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
2026-11-03 14:45:54
UTC ·
(1 week ago)
LogGuard auto-report | score=125 | flags=web-app-attack | reasons=[+35] burst_10s_hard: 238 req in 10s (threshold 100); [+20] burst_60s_suspicious: 238 req in 60s (threshold 200); [+20] burst_60s_suspicious: 238 req in 60s (threshold 200); [+25] path ...
show more
LogGuard auto-report | score=125 | flags=web-app-attack | reasons=[+35] burst_10s_hard: 238 req in 10s (threshold 100); [+20] burst_60s_suspicious: 238 req in 60s (threshold 200); [+20] burst_60s_suspicious: 238 req in 60s (threshold 200); [+25] path_diversity_severe: 233 unique paths in 60s (threshold 50); [+25] probe_paths: Hit 85 known probe paths: /..../..../..../..../.env, /..../..../..../..../proc/self/environ, /.aws/config, /.changeset/config.json, /.docker/.env
show less
Web App Attack
🇩🇪
igerman
2026-11-03 14:40:45
UTC ·
(1 week ago)
caddy probes: env-probe: GET /.env.config(DROP), GET /.env.credentials(DROP), GET /.env.dev.local(DROP), GET /.env.development(DROP), GET /.env.development.local(DROP), GET /.env.keys(DROP), GET /.env.preprod(DROP), GET /.env.production.local(DROP), ...
show more
caddy probes: env-probe: GET /.env.config(DROP), GET /.env.credentials(DROP), GET /.env.dev.local(DROP), GET /.env.development(DROP), GET /.env.development.local(DROP), GET /.env.keys(DROP), GET /.env.preprod(DROP), GET /.env.production.local(DROP), GET /.env.secret(DROP), GET /.env.staging(DROP), GET /.env.staging.local(DROP), GET /.env.supabase(DROP), GET /.env.test(DROP), GET /.env.testing(DROP), GET /config.env(DROP), GET /sendgrid.env(DROP) | web: GET /.amplifyrc(DROP), GET /.bashrc(DROP), GET /.firebaserc(DROP), GET /.zshrc(DROP), GET /3uzbiuawgaz10wttfjw6(DROP), GET /5fh0im3lmn9850i77ong(DROP), GET /key.pem(DROP), GET /server.key(DROP), POST /graphql(DROP)
show less
Web App Attack
🇳🇱
Alt255
2026-11-03 14:20:57
UTC ·
(1 week ago)
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.74.200.138 - - [03/Nov/2026:15:20:52 +0100] "GET /laravel/.env HTTP/1.1" 404 2070 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; comp ...
show more
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.74.200.138 - - [03/Nov/2026:15:20:52 +0100] "GET /laravel/.env HTTP/1.1" 404 2070 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
i-turnradio.nl
2026-11-03 14:17:27
UTC ·
(1 week ago)
2026-11-03 @ 15:17:07 (CET) ~ Blocked for trying to access: /uploads../.env
Web App Attack
🇸🇪
vaia.cloud
2026-11-03 13:30:03
UTC ·
(1 week ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
