🇧🇷
ICS Labs
2026-10-20 16:50:13
(20 hours ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-10-20 UTC.
Brute-Force
Exploited Host
🇩🇪
IVski.com
2026-10-20 02:13:40
(1 day ago)
IVski WAF | Path traversal detected - double encoding or cgi-bin abuse
Hacking
Brute-Force
Web App Attack
🇫🇷
SpaceHost-Server
2026-10-19 22:21:50
(1 day ago)
Brute-Force
Web App Attack
🇳🇱
oisecnet
2026-10-19 21:02:35
(1 day ago)
Automated report: Unauthorized vulnerability scanning detected on 2026-10-19. 3013 requests from thi ...
show more
Automated report: Unauthorized vulnerability scanning detected on 2026-10-19. 3013 requests from this IP.
show less
Port Scan
Hacking
Web App Attack
🇺🇸
leasj
2026-10-19 19:22:47
(1 day ago)
Observed Scanned 23 known-sensitive endpoint(s), e.g.: /.env.config, /@fs/..%2f..%2f..%2f..%2f..%2fr ...
show more
Observed Scanned 23 known-sensitive endpoint(s), e.g.: /.env.config, /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw??, /api/admin/config.json, /.docker/config.json, /.env.secret.
show less
Hacking
Bad Web Bot
Web App Attack
🇧🇷
dermatovirtual
2026-10-19 16:29:13
(1 day ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 163 unauthorized requests recorded between 2026-10-18 16:27:49 UTC and 2026-10-18 16:27:58 UTC (rate: ~163 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-10-18 16:27:57 UTC] IP: 34.75.45.189 - W3C IIS (Port 443): GET /.env.production -> HTTP 404 [CLIENT: 34.75.45.189]
[2026-10-18 16:27:58 UTC] IP: 34.75.45.189 - W3C IIS (Port 443): GET /@fs/root/.env -> HTTP 404 [CLIENT: 34.75.45.189]
[2026-10-18 16:27:58 UTC] IP: 34.75.45.189 - W3C IIS (Port 443): GET /files../.env -> HTTP 404 [CLIENT: 34.75.45.189]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 09:23:56
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 34.75.45.189 (189.45.75.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.75.45.189 (189.45.75.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 05:23:50.495362 2026] [security2:error] [pid 18880:tid 18880] [client 34.75.45.189:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.assistguide.net"] [uri "/.env.keys"] [unique_id "atXhprAAuUYYk0Ag4hA54gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-10-19 08:57:56
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
🇺🇸
mishan
2026-10-19 08:28:06
(2 days ago)
34.75.45.189 - - [19/Oct/2026:01:28:05 -0700] "GET /.env?import&raw HTTP/1.1" 200 294650 "-" "Mozill ...
show more
34.75.45.189 - - [19/Oct/2026:01:28:05 -0700] "GET /.env?import&raw HTTP/1.1" 200 294650 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
...
show less
Web App Attack
🇺🇸
infra-monitor
2026-10-19 08:00:05
(2 days ago)
Automated ban via infra-monitor: suspicious-probe, mgmt-path-probe, crowdsecurity/http-cve-2021-4177 ...
show more
Automated ban via infra-monitor: suspicious-probe, mgmt-path-probe, crowdsecurity/http-cve-2021-41773, +6 more
show less
Port Scan
Hacking
Bad Web Bot
Web App Attack
🇬🇧
Andrew
2026-10-19 07:52:34
(2 days ago)
34.75.45.189 - - [19/Oct/2026:08:52:33 +0100] "GET /.env.supabase HTTP/1.1" 404 18363 "-" "Mozilla/5 ...
show more
34.75.45.189 - - [19/Oct/2026:08:52:33 +0100] "GET /.env.supabase HTTP/1.1" 404 18363 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
34.75.45.189 - - [19/Oct/2026:08:52:33 +0100] "GET /.gitlab-ci.yml HTTP/1.1" 404 18359 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
34.75.45.189 - - [19/Oct/2026:08:52:33 +0100] "GET /.github/workflows/deploy.yml HTTP/1.1" 404 20294 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)"
34.75.45.189 - - [19/Oct/2026:08:52:33 +0100] "GET /firebase-adminsdk.json HTTP/1.1" 404 20283 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
34.75.45.189 - - [19/Oct/2026:08:52:33 +0100] "GET /Dockerfile HTTP/1.1" 404 20276 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://develop
...
show less
Hacking
Web App Attack
🇩🇪
pscriptos
2026-10-19 07:22:03
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇬🇧
stevendodd
2026-10-19 07:07:26
(2 days ago)
34.75.45.189 - - [19/Oct/2026:08:07:26 +0100] "GET /.env.preprod HTTP/1.1" 404 262 "-" "Mozilla/5.0 ...
show more
34.75.45.189 - - [19/Oct/2026:08:07:26 +0100] "GET /.env.preprod HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.75.45.189 - - [19/Oct/2026:08:07:26 +0100] "GET /.ssh/config HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.75.45.189 - - [19/Oct/2026:08:07:26 +0100] "GET /.ssh/id_rsa HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
34.75.45.189 - - [19/Oct/2026:08:07:26 +0100] "GET /.ssh/id_ed25519 HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.75.45.189 - - [19/Oct/2026:08:07:26 +0100] "GET /.env.supabase HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.75.45.189 - - [19/Oct/2026:08:07:26 +0100] "GET /.envrc HTTP/1.1" 404 4328 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
34.75.45.189 - - [19/Oct/2026:08:07:26 +01
...
show less
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-10-19 06:50:43
(2 days ago)
Excessive multi-domain requests
Brute-Force
🇫🇷
masterguru
2026-10-19 06:45:39
(2 days ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.75.45.189 (US/United States/189.45 ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.75.45.189 (US/United States/189.45.75.34.bc.googleusercontent.com): 2 in the last 3600 secs (0-196)
show less
Hacking
