🇧🇷
ICS Labs
2026-11-04 14:35:29
UTC ·
(1 week ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-11-04 UTC.
Brute-Force
Exploited Host
Anonymous
2026-11-04 00:25:39
UTC ·
(1 week ago)
[Tue Nov 03 01:16:30.036557 2026] [authz_core:error] [pid 4190441:tid 4190485] [remote 34.81.77.74:37306] AH01630: client denied by server configuration: /shr/sdb1/WebDev/Infrastructure/LOC-Chatbot/public/
[Tue Nov 03 01:16:30.503718 2026] [authz_cor ...
show more
[Tue Nov 03 01:16:30.036557 2026] [authz_core:error] [pid 4190441:tid 4190485] [remote 34.81.77.74:37306] AH01630: client denied by server configuration: /shr/sdb1/WebDev/Infrastructure/LOC-Chatbot/public/
[Tue Nov 03 01:16:30.503718 2026] [authz_core:error] [pid 4190441:tid 4190487] [remote 34.81.77.74:37306] AH01630: client denied by server configuration: /shr/sdb1/WebDev/Infrastructure/LOC-Chatbot/public/robots.txt
[Tue Nov 03 01:16:31.077770 2026] [authz_core:error] [pid 4190441:tid 4190489] [remote 34.81.77.74:37306] AH01630: client denied by server configuration: /shr/sdb1/WebDev/Infrastructure/LOC-Chatbot/public/sitemap.xml
[Tue Nov 03 01:16:31.379043 2026] [authz_core:error] [pid 4190441:tid 4190491] [remote 34.81.77.74:37306] AH01630: client denied by server configuration: /shr/sdb1/WebDev/Infrastructure/LOC-Chatbot/public/sitemap_index.xml
[Tue Nov 03 01:16:31.695254 2026] [authz_core:error] [pid 4190441:tid 4190493] [remote 34.81.77.74:37306] AH01630: client denied by server
...
show less
Brute-Force
Web App Attack
Anonymous
2026-11-03 12:05:14
UTC ·
(1 week ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇩🇪
reznekcs
2026-11-03 06:01:46
UTC ·
(1 week ago)
Blocked by UFW firewall
Brute-Force
🇭🇺
DumaNet
2026-11-03 05:07:00
UTC ·
(1 week ago)
Web app attack attempts, scanning for vulnerability.
Date: 2026 Nov 02. 17:54:12
Source IP: 34.81.77.74
Portion of the log(s):
34.81.77.74 - [02/Nov/2026:17:54:12 +0100] "GET /.env.credentials HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Kim ...
show more
Web app attack attempts, scanning for vulnerability.
Date: 2026 Nov 02. 17:54:12
Source IP: 34.81.77.74
Portion of the log(s):
34.81.77.74 - [02/Nov/2026:17:54:12 +0100] "GET /.env.credentials HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.81.77.74 - [02/Nov/2026:17:54:12 +0100] "GET /.env.dev.local HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.81.77.74 - [02/Nov/2026:17:54:12 +0100] "GET /webmail.js.map HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.81.77.74 - [02/Nov/2026:17:54:11 +0100] "GET /asset-manifest.json HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
34.81.77.74 - [02/Nov/2026:17:54:11 +0100] "GET /3kc5vhoosbezt9nwehep HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support
show less
Web App Attack
🇫🇮
oh.mg
2026-11-03 00:57:55
UTC ·
(1 week ago)
[Tue Nov 03 01:57:54.735749 2026] [security2:error] [pid 1908516:tid 1908540] [client 34.81.77.74:0] [client 34.81.77.74] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/shar ...
show more
[Tue Nov 03 01:57:54.735749 2026] [security2:error] [pid 1908516:tid 1908540] [client 34.81.77.74:0] [client 34.81.77.74] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "api.mmn.ca"] [uri "/files../.env"] [unique_id "aukxktFaQ3uJqiNkzrYPHQAAANY"]
[Tue Nov 03 01:57:54.736000 2026] [security2:error] [pid 1914331:tid 1914334] [client 34.81.77.74:0] [client 34.81.77.74] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-eva
...
show less
Web App Attack
Bad Web Bot
🇱🇺
SiteXL
2026-11-03 00:35:09
UTC ·
(1 week ago)
Automated Fail2Ban detection: malicious activity observed; source IP was banned.
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-11-02 22:20:11
UTC ·
(1 week ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-11-02 22:10:05
UTC ·
(1 week ago)
34.81.77.74 - - [02/Nov/2026:23:10:01 +0100] "GET /wp-config.php.bak HTTP/2.0" 403 294 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email])"
34.81.77.74 - - [02/Nov/2026:23:10:01 +0100] "GET /wp-config.ph ...
show more
34.81.77.74 - - [02/Nov/2026:23:10:01 +0100] "GET /wp-config.php.bak HTTP/2.0" 403 294 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email])"
34.81.77.74 - - [02/Nov/2026:23:10:01 +0100] "GET /wp-config.php.old HTTP/2.0" 404 290 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.81.77.74 - - [02/Nov/2026:23:10:01 +0100] "GET /wp-config.php~ HTTP/2.0" 403 294 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.81.77.74 - - [02/Nov/2026:23:10:02 +0100] "GET /userfiles?path=../../../../proc/self/environ HTTP/2.0" 404 290 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.81.77.74 - - [02/Nov/2026:23:10:02 +0100] "GET /cache/original/%2e%2e/.env HTTP/2.0" 404 290 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.c
show less
Web App Attack
Brute-Force
🇪🇸
masterguru
2026-11-02 21:14:13
UTC ·
(1 week ago)
BAD BOT - Detected and Blocked.. Matched phrase "GPTBot" at REQUEST_HEADERS:User-Agent. (1100000-122)
Bad Web Bot
🇧🇪
voormedia
2026-11-02 21:13:43
UTC ·
(1 week ago)
Accessed trap at '/.env'
Web App Attack
Anonymous
2026-11-02 21:06:34
UTC ·
(1 week ago)
access denied too many times (more than 12 attempts in 60 seconds)
...
Web App Attack
Brute-Force
🇩🇪
verlon
2026-11-02 21:00:58
UTC ·
(1 week ago)
2026/11/02 22:00:50 [error] 1863447#1863447: *925527 access forbidden by rule, client: 34.81.77.74, server: digelstorebudapest.hu, request: "GET /.env.save HTTP/2.0", host: "digelstorebudapest.hu"
2026/11/02 22:00:51 [error] 1863447#1863447: *925527 ...
show more
2026/11/02 22:00:50 [error] 1863447#1863447: *925527 access forbidden by rule, client: 34.81.77.74, server: digelstorebudapest.hu, request: "GET /.env.save HTTP/2.0", host: "digelstorebudapest.hu"
2026/11/02 22:00:51 [error] 1863447#1863447: *925527 access forbidden by rule, client: 34.81.77.74, server: digelstorebudapest.hu, request: "GET /.git-credentials HTTP/2.0", host: "digelstorebudapest.hu"
2026/11/02 22:00:51 [error] 1863447#1863447: *925527 access forbidden by rule, client: 34.81.77.74, server: digelstorebudapest.hu, request: "GET /.gitlab-ci.yml HTTP/2.0", host: "digelstorebudapest.hu"
...
show less
Hacking
Web App Attack
🇭🇺
bcsaba
2026-11-02 18:43:31
UTC ·
(1 week ago)
Multiple web server 400 error codes from same source ip.
34.81.77.74 - - [02/Nov/2026:19:43:23 +0100] "GET /dashboard HTTP/2.0" 403 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safar ...
show more
Multiple web server 400 error codes from same source ip.
34.81.77.74 - - [02/Nov/2026:19:43:23 +0100] "GET /dashboard HTTP/2.0" 403 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
show less
Web App Attack
Brute-Force
🇳🇱
Site.eu
2026-11-02 18:07:21
UTC ·
(1 week ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack