🇩🇪
rh24
2026-10-28 08:23:55
(13 hours ago)
(badbots) Bad bot user-agent [redacted] from 34.85.189.144 (US/United States/144.189.85.34.bc.googleusercontent.com)
Hacking
🇩🇪
FeG Deutschland
2026-10-28 08:17:47
(14 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-10-28 06:50:15
(15 hours ago)
[Wed Oct 28 00:50:08.330343 2026] [authz_core:error] [pid 137917:tid 140257029502528] [client 34.85.189.144:55574] AH01630: client denied by server configuration: /var/www/horde/.htpasswd
[Wed Oct 28 00:50:14.302773 2026] [authz_core:error] [pid 1379 ...
show more
[Wed Oct 28 00:50:08.330343 2026] [authz_core:error] [pid 137917:tid 140257029502528] [client 34.85.189.144:55574] AH01630: client denied by server configuration: /var/www/horde/.htpasswd
[Wed Oct 28 00:50:14.302773 2026] [authz_core:error] [pid 137917:tid 140256987539008] [client 34.85.189.144:55574] AH01630: client denied by server configuration: /var/www/horde/rclone.conf
[Wed Oct 28 00:50:14.715374 2026] [authz_core:error] [pid 137917:tid 140256811292224] [client 34.85.189.144:55574] AH01630: client denied by server configuration: /var/www/horde/lib/.env
...
show less
Bad Web Bot
🇬🇧
openstrike.co.uk
2026-10-28 06:14:23
(16 hours ago)
1477 attacks on directory traversals, env grabbing URLs (type 2), VC URLs, env grabbing URLs, config grabbing URLs (type 2), PHP URLs, password/key grabbing URLs:
GET /..%2f..%2f.env HTTP/1.1
GET /api/fs/read?allowOutsideWorkspace=true&path=/proc/sel ...
show more
1477 attacks on directory traversals, env grabbing URLs (type 2), VC URLs, env grabbing URLs, config grabbing URLs (type 2), PHP URLs, password/key grabbing URLs:
GET /..%2f..%2f.env HTTP/1.1
GET /api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /dist../.env HTTP/1.1
GET /config/settings.local.yml HTTP/1.1
GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
Bedios GmbH
2026-10-28 06:10:45
(16 hours ago)
Scanning for exposed credentials and private keys.
Hacking
2026-10-28 06:05:50
(16 hours ago)
Web application attack: grafana cve 2021 43798; Probing for exposed secret / credential files; Web application attack: http cve 2021 41773; Web application attack: http sensitive files; Web application attack: http path traversal probing
Hacking
Web App Attack
2026-10-28 06:03:20
(16 hours ago)
34.85.189.144 - - [28/Oct/2026:07:03:18 +0100] "GET /sitemap.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.85.189.144 - - [28/Oct/2026:07:03:18 +0100] "GET /sitemap_index.xml HTTP/1.1" 404 518 "- ...
show more
34.85.189.144 - - [28/Oct/2026:07:03:18 +0100] "GET /sitemap.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.85.189.144 - - [28/Oct/2026:07:03:18 +0100] "GET /sitemap_index.xml HTTP/1.1" 404 518 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.85.189.144 - - [28/Oct/2026:07:03:18 +0100] "GET /admin/login HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
34.85.189.144 - - [28/Oct/2026:07:03:18 +0100] "GET /backoffice HTTP/1.1" 404 5515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
34.85.189.144 - - [28/Oct/2026:07:03:18 +0100] "GET /auth HTTP/1.1" 404 5515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
3
...
show less
DDoS Attack
🇫🇷
spot
2026-10-28 00:08:52
(22 hours ago)
34.85.189.144 - - [28/Oct/2026:00:08:51 +0000] "GET /.env.staging.local HTTP/1.1" 404 488 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googleb ...
show more
34.85.189.144 - - [28/Oct/2026:00:08:51 +0000] "GET /.env.staging.local HTTP/1.1" 404 488 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
VPN IP
2026-10-27 22:36:27
(23 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-10-27 22:19:48
(23 hours ago)
Web attack/malicious scanning detected
Web App Attack
2026-10-27 21:39:39
(1 day ago)
IP matched detection query Many sub paths, bad urls forwarding.
Brute-Force
2026-10-27 19:38:38
(1 day ago)
IP matched detection query many 3xx errors.
Brute-Force
🇧🇪
boxed-it
2026-10-27 08:19:27
(1 day ago)
GET /console (Tarpitted for 11s, wasted 720B)
Web App Attack
🇩🇪
updown.io
2026-10-27 07:35:19
(1 day ago)
{"level":"info","ts":1793086517.773916,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.85.189.144","remote_port":"46820","client_ip":"34.85.189.144","proto":"HTTP/2.0","method":"GET","host":"status.legume.uk","uri": ...
show more
{"level":"info","ts":1793086517.773916,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.85.189.144","remote_port":"46820","client_ip":"34.85.189.144","proto":"HTTP/2.0","method":"GET","host":"status.legume.uk","uri":"/api/.env","headers":{"Accept-Encoding":["gzip"],"Accept":["*/*"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.legume.uk","ech":false}},"bytes_read":0,"user_id":"","duration":0.000189323,"size":0,"status":429,"resp_headers":{"Retry-After":["1"],"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
{"level":"info","ts":1793086517.7929766,"logger":"http.log.access.log1","msg
...
show less
DDoS Attack
Web App Attack
🇬🇧
openstrike.co.uk
2026-10-27 06:15:54
(1 day ago)
1680 attacks on env grabbing URLs, directory traversals, PHP URLs, VC URLs, config grabbing URLs (type 2), password/key grabbing URLs, env grabbing URLs (type 2):
GET /prisma/.env HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /document.php?modulepart=sys ...
show more
1680 attacks on env grabbing URLs, directory traversals, PHP URLs, VC URLs, config grabbing URLs (type 2), password/key grabbing URLs, env grabbing URLs (type 2):
GET /prisma/.env HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1
GET /.git/config HTTP/1.1
GET /config/settings.local.yml HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/1.1
show less
Hacking
Web App Attack
