🇮🇹
VHosting
2026-11-09 17:30:05
UTC ·
(59 minutes ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
Vano Ganzzz
2026-11-09 13:29:08
UTC ·
(5 hours ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.config/gcloud/application_default_credentials.json
Timestamp: 2026-11-09T13:29:08Z
Ray ID: a57d2a23b98cfe17
UA ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.config/gcloud/application_default_credentials.json
Timestamp: 2026-11-09T13:29:08Z
Ray ID: a57d2a23b98cfe17
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Bad Web Bot
🇩🇪
Mr-Money
2026-11-09 10:01:55
UTC ·
(8 hours ago)
scenario: crowdsecurity/http-sensitive-files - events: 5
Web App Attack
Hacking
🇫🇮
KTSTechnology
2026-11-09 09:19:57
UTC ·
(9 hours ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇳🇱
Alt255
2026-11-09 09:02:45
UTC ·
(9 hours ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.87.121.247 - - [09/Nov/2026:10:02:30 +0100] "GET /.git/config HTTP/1.1" 404 73174 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWe ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.87.121.247 - - [09/Nov/2026:10:02:30 +0100] "GET /.git/config HTTP/1.1" 404 73174 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
jbcrn
2026-11-09 06:58:51
UTC ·
(11 hours ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537. ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-11-09 05:59:45
UTC ·
(12 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-11-09 03:25:02
UTC ·
(15 hours ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇩🇪
Dominik Lysiak
2026-11-09 03:02:25
UTC ·
(15 hours ago)
34.87.121.247 - - [09/Nov/2026:04:02:24 +0100] "GET /.git/config HTTP/1.1" 502 323 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.87.121.247 - - [09/Nov/2026:04:02:24 +0100] "GET /.git/c ...
show more
34.87.121.247 - - [09/Nov/2026:04:02:24 +0100] "GET /.git/config HTTP/1.1" 502 323 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.87.121.247 - - [09/Nov/2026:04:02:24 +0100] "GET /.git/config HTTP/1.1" 502 323 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.87.121.247 - - [09/Nov/2026:04:02:25 +0100] "GET /.env HTTP/1.1" 502 323 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇨🇦
Anytech
2026-11-09 02:40:47
UTC ·
(15 hours ago)
Blocked by ConnMonitor
Web App Attack
🇨🇭
TheCoon
2026-11-08 11:10:27
UTC ·
(1 day ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇧🇷
guguabx
2026-11-05 22:02:53
UTC ·
(3 days ago)
Taboka Proteção: caiu na armadilha: /.git/config
Web App Attack
Bad Web Bot
🇺🇸
Epimetheus
2026-11-04 20:40:26
UTC ·
(4 days ago)
Unauthorized access attempts:
[GET] /webroot/index.php/_environment
[GET] /github/.env
[GET] /firebase-adminsdk.json
[GET] /google-key.json
[GET] /public_html/phpinfo.php
[GET] /sa.json
[GET] /public/phpinfo.php
[GET] /wp-admin/phpinfo.php
[GET] /ph ...
show more
Unauthorized access attempts:
[GET] /webroot/index.php/_environment
[GET] /github/.env
[GET] /firebase-adminsdk.json
[GET] /google-key.json
[GET] /public_html/phpinfo.php
[GET] /sa.json
[GET] /public/phpinfo.php
[GET] /wp-admin/phpinfo.php
[GET] /phpversion.php
[GET] /cpanel/phpinfo.php
[GET] /google-credentials.json
[GET] /stage/.env
[GET] /_phpinfo.php
[GET] /info.php.bak
[GET] /test/phpinfo.php
[GET] /uat/phpinfo.php
[GET] /job/.env
[GET] /phpinfo.php~
[GET] /mongodb/.env
[GET] /tmp/phpinfo.php
[GET] /mysql/.env
[GET] /queue/.env
[GET] /key.json
[GET] /qa/.env
[GET] /debug.php
[GET] /www/phpinfo.php
[GET] /phpinfo.php.bak
[GET] /cms/.env
[GET] /cache/.env
[GET] /old/.env
[GET] /bulk/.env
[GET] /vendor/.env
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Web App Attack
🇩🇪
Hazzard
2026-11-04 20:38:11
UTC ·
(4 days ago)
34.87.121.247 (SG/Singapore/-/Singapore/247.121.87.34.bc.googleusercontent.com/[redacted]), more than 60 Apache 403 hits
Hacking
🇸🇪
vaia.cloud
2026-11-04 19:45:02
UTC ·
(4 days ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack