🇧🇷
ICS Labs
2026-11-09 20:07:53
UTC ·
(4 days ago)
ICS Labs threat intelligence (ICS Feeds): Exploited Host. Last observed 2026-11-09 UTC.
Exploited Host
🇦🇺
paulshipley.com.au
2026-11-09 10:27:38
UTC ·
(4 days ago)
[Mon Nov 09 21:27:37.568622 2026] [security2:error] [pid 105105] [client 34.93.83.10:47864] [client 34.93.83.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST- ...
show more
[Mon Nov 09 21:27:37.568622 2026] [security2:error] [pid 105105] [client 34.93.83.10:47864] [client 34.93.83.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/"] [unique_id "avGgGalbQtiNDXjCyAeohAAAAAY"]
...
show less
Web App Attack
🇫🇷
security.rdmc.fr
2026-11-09 08:50:17
UTC ·
(5 days ago)
Activity from blacklisted IP
Hacking
🇫🇷
DuffMan13680
2026-11-09 08:48:50
UTC ·
(5 days ago)
34.93.83.10 - - [09/Nov/2026:08:48:46 +0000] "GET /mailer/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.93.83.10 - - [09/Nov/2026:08:48:47 +0000] "GET /mail/.env H ...
show more
34.93.83.10 - - [09/Nov/2026:08:48:46 +0000] "GET /mailer/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.93.83.10 - - [09/Nov/2026:08:48:47 +0000] "GET /mail/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.93.83.10 - - [09/Nov/2026:08:48:47 +0000] "GET /mailing/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.93.83.10 - - [09/Nov/2026:08:48:49 +0000] "GET /mailgun/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.93.83.10 - - [09/Nov/2026:08:48:49 +0000] "GET /mailjet/.env HTTP/1.1" 404 14 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-11-09 08:47:46
UTC ·
(5 days ago)
csagent: score 19.9: secrets grab x2; 1 domain(s) in 2s
Web App Attack
🇺🇸
Victor López
2026-11-09 08:33:09
UTC ·
(5 days ago)
valquintero.com.co 34.93.83.10 - - [09/Nov/2026:03:33:07 -0500] "GET /.git/config HTTP/2.0" 404 10812 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" MISS
valquintero.com.co 34.93. ...
show more
valquintero.com.co 34.93.83.10 - - [09/Nov/2026:03:33:07 -0500] "GET /.git/config HTTP/2.0" 404 10812 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" MISS
valquintero.com.co 34.93.83.10 - - [09/Nov/2026:03:33:08 -0500] "GET /.env.local HTTP/2.0" 404 10812 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" MISS
valquintero.com.co 34.93.83.10 - - [09/Nov/2026:03:33:09 -0500] "GET /.env.production HTTP/2.0" 404 10812 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" MISS
...
show less
Hacking
Web App Attack
🇩🇪
Vegascosmetics
2026-11-09 07:53:22
UTC ·
(5 days ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): Abuse 100 / BAN. IP is on the AbuseIPDB blacklist and was blocked on the first request.
Hacking
Exploited Host
Web App Attack
🇮🇹
CoreTech srl
2026-11-09 04:28:49
UTC ·
(5 days ago)
[DC: IP:151.1.252.27] ntopng alert: blacklisted_client_contact
Hacking
🇩🇪
paissangroup
2026-11-09 04:24:39
UTC ·
(5 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
dot.mg
2026-11-09 03:36:02
UTC ·
(5 days ago)
Bad behaviour
Web Spam
🇺🇸
RamSet
2026-11-09 03:32:33
UTC ·
(5 days ago)
[swy] HTTP-Probe on port 443 (via domain). 95 distinct paths probed in 25s. Sustained 98 req/min, 94 nonexistent paths (404). Paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging, /.env.development, /.env.test, /.env.remote, /.env ...
show more
[swy] HTTP-Probe on port 443 (via domain). 95 distinct paths probed in 25s. Sustained 98 req/min, 94 nonexistent paths (404). Paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging, /.env.development, /.env.test, /.env.remote, /.env.bak, /.env.backup, /.env.save, /.env.old, /.env.sample, /.env.example, /.env.dev, /.env.prod, /.env.stage, /.env.ci, /.env.docker, /.env.live, /.env.preprod, /.env.uat, /.env.dist, /.env.swp, /.env.txt, /.env.json, /.env.yaml, /.env.yml, /app/.env, /apps/.env, /api/.env, /web/.env, /site/.env, /public/.env, /admin/.env, /backend/.env, /server/.env, /frontend/.env, /src/.env, /core/.env, /core/app/.env, /config/.env, /private/.env, /application/.env, /bootstrap/.env, /database/.env, /storage/.env, /var/www/.env, /var/www/html/.env, /current/.env, /release/.env, /releases/.env, /shared/.env, /deploy/.env, /build/.env, /dist/.env, /public_html/.env, /htdocs/.env, /www/.env, /html/.env
show less
Bad Web Bot
Web App Attack
🇩🇪
XICTRON
2026-11-09 00:10:04
UTC ·
(5 days ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇳🇱
Alt255
2026-11-08 23:24:50
UTC ·
(5 days ago)
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.93.83.10 - - [09/Nov/2026:00:24:37 +0100] "GET /.git/config HTTP/1.1" 403 179 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit ...
show more
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.93.83.10 - - [09/Nov/2026:00:24:37 +0100] "GET /.git/config HTTP/1.1" 403 179 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
Anonymous
2026-11-08 20:04:31
UTC ·
(5 days ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
Anonymous
2026-11-08 19:21:26
UTC ·
(5 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack