🇫🇷
Murazaki
2026-11-13 08:40:06
UTC ·
(31 minutes ago)
signaling.balamb.fr 34.81.11.19 - - [13/Nov/2026:09:40:02 +0100] "GET /mailer/.env HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "172.22.0.44:8081"
signaling.balamb.fr 34. ...
show more
signaling.balamb.fr 34.81.11.19 - - [13/Nov/2026:09:40:02 +0100] "GET /mailer/.env HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "172.22.0.44:8081"
signaling.balamb.fr 34.81.11.19 - - [13/Nov/2026:09:40:02 +0100] "GET /mail/.env HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "172.22.0.44:8081"
signaling.balamb.fr 34.81.11.19 - - [13/Nov/2026:09:40:03 +0100] "GET /mailing/.env HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "172.22.0.44:8081"
signaling.balamb.fr 34.81.11.19 - - [13/Nov/2026:09:40:05 +0100] "GET /mailgun/.env HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "172.22.0.44:8081"
signaling.balamb.fr 34.81.11.19 - - [13/Nov/2026:09:40:06 +0100] "GET /mailjet/.env HTTP/1.1
...
show less
Bad Web Bot
🇫🇷
Al3x
2026-11-13 08:07:01
UTC ·
(1 hour ago)
CrowdSec-detected attack, scenario(s): http-probing, http-sensitive-files -- e.g. GET / (HTTP 404)
Bad Web Bot
Web App Attack
🇫🇮
mnazibo
2026-11-13 07:15:13
UTC ·
(1 hour ago)
Date: Nov 13 10:09:41 2026 EAT | Reported IP: 34.81.11.19 mod_security | id: 932130 932235 932260 933135 934100 934130 942151 942550 949110 930130 920440 920500 | TW/usernameab.my_domain/- | Connections: 1 | Blocked: Permanent Block: [LF_MODSEC] | Lo ...
show more
Date: Nov 13 10:09:41 2026 EAT | Reported IP: 34.81.11.19 mod_security | id: 932130 932235 932260 933135 934100 934130 942151 942550 949110 930130 920440 920500 | TW/usernameab.my_domain/- | Connections: 1 | Blocked: Permanent Block: [LF_MODSEC] | Logs: ; Remote Command Execution: Unix Shell Expression Found; Remote Command Execution: Unix Shell Expression Found; Remote Command Execution: Unix Command Injection (command without evasion); Remote Command Execution: Unix Command Injection (command without evasion); Remote Command Execution: Direct Unix Command Execution; Remote Command Execution: Direct Unix Command Execution; PHP Injection Attack: Variable Access Found; PHP Injection Attack: Variable Access Found; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection
show less
SQL Injection
Brute-Force
Bad Web Bot
🇫🇷
dynamix
2026-11-13 06:52:02
UTC ·
(2 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
CollideTech
2026-11-13 06:23:52
UTC ·
(2 hours ago)
probing for vulnerabilities
Web App Attack
🇬🇧
KTSTechnology
2026-11-13 05:43:17
UTC ·
(3 hours ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇩🇪
wpadm4
2026-11-13 04:45:00
UTC ·
(4 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
tdamg
2026-11-13 04:34:40
UTC ·
(4 hours ago)
Automated probing for secret and config files (.env, cloud credential files): 2 refused requests to 2 distinct paths (HTTP 403/404), 2026-11-13 04:34 to 04:34 UTC. Blocked at firewall.
Web App Attack
Hacking
🇬🇧
consul.to
2026-11-13 02:07:28
UTC ·
(7 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
dot.mg
2026-11-12 23:49:02
UTC ·
(9 hours ago)
Bad behaviour
Web Spam
🇩🇪
paissangroup
2026-11-12 23:12:12
UTC ·
(9 hours ago)
Multiple WAF Violations
Web App Attack
🇩🇪
ghostwarriors
2026-11-12 22:20:05
UTC ·
(10 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-12 22:16:37
UTC ·
(10 hours ago)
34.81.11.19 - - [12/Nov/2026:23:16:32 +0100] "GET /.env.local HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.81.11.19 - - [12/Nov/2026:23:16:32 +0100] "GET /.env.produc ...
show more
34.81.11.19 - - [12/Nov/2026:23:16:32 +0100] "GET /.env.local HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.81.11.19 - - [12/Nov/2026:23:16:32 +0100] "GET /.env.production HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.81.11.19 - - [12/Nov/2026:23:16:32 +0100] "GET /.env.staging HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.81.11.19 - - [12/Nov/2026:23:16:33 +0100] "GET /.env.development HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.81.11.19 - - [12/Nov/2026:23:16:33 +0100] "GET /.env.test HTTP/1.1" 404 516 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.81.11.19 - - [12/Nov/2026:23:16:33 +0100] "GE
show less
Web App Attack
Hacking
Anonymous
2026-11-12 22:12:33
UTC ·
(10 hours ago)
[ssd5.kdns.gr] httpd-config-scan: sites=sigasigacollective.com; logs=/var/log/httpd/domains/sigasigacollective.com.log; samples=/.env | /.env.local | /.env.production
Hacking
Web App Attack
Anonymous
2026-11-12 20:57:04
UTC ·
(12 hours ago)
Flagged as abuse by IisGuard automated detection (tier L5, score 90/100). Reasons: Reputation=1, BadPath=25, Diversity=10, CanaryOverride=90.
Web App Attack
Bad Web Bot