🇬🇧
openstrike.co.uk
2026-10-22 05:15:26
(11 hours ago)
223 attacks on env grabbing URLs, PHP URLs, env grabbing URLs (type 2), password/key grabbing URLs, ...
show more
223 attacks on env grabbing URLs, PHP URLs, env grabbing URLs (type 2), password/key grabbing URLs, VC URLs, directory traversals, config grabbing URLs (type 2):
GET /api/system/fileView?file=/app/.env HTTP/1.1
POST /icecoder/lib/file-control.php HTTP/1.1
GET /api/system/fileView?file=/proc/self/environ HTTP/1.1
GET /.git-credentials HTTP/1.1
GET /.git/config HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /secrets.json HTTP/1.1
show less
Hacking
Web App Attack
🇹🇷
Jova
2026-10-21 23:39:29
(17 hours ago)
Exploit attempts against a web server: 2 requests.
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-21 22:01:09
(19 hours ago)
Auto-ban: >3000 req/min op 2026-10-21
Web App Attack
SSH
Hacking
2026-10-21 17:47:01
(23 hours ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 35.189.253.163 (BE/Belgium/163.253.189.35.bc ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 35.189.253.163 (BE/Belgium/163.253.189.35.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.189.253.163 - - [21/Oct/2026:19:46:59 +0200] "GET /uploads../.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.189.253.163 - - [21/Oct/2026:19:46:59 +0200] "GET /api%2F.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
35.189.253.163 - - [21/Oct/2026:19:46:59 +0200] "GET /static../.env HTTP/2.0" 406 317 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
show less
Port Scan
🇳🇱
Savvii
2026-10-21 17:30:12
(23 hours ago)
20 attempts against mh-misbehave-ban on bud
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-21 17:29:25
(23 hours ago)
(mod_security) mod_security (id:949110) triggered by 35.189.253.163 (BE/Belgium/163.253.189.35.bc.go ...
show more
(mod_security) mod_security (id:949110) triggered by 35.189.253.163 (BE/Belgium/163.253.189.35.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇩🇪
ghostwarriors
2026-10-21 17:20:09
(23 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 17:03:05
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.189.253.163 (163.253.189.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.189.253.163 (163.253.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 13:02:58.116543 2026] [security2:error] [pid 31358:tid 31358] [client 35.189.253.163:36418] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||stkm.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "stkm.com"] [uri "/z9x8c7v6b5-debug-trigger-stkm.com"] [unique_id "atjwQqcUQGgOu6cLfte_bAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-21 17:01:18
(1 day ago)
[ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.189.253.163 - - [21/Oct/2026:19:01:10 +0200] "GET /@fs/src/.env?raw?? HTTP/2.0" 301 516 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-10-21 16:54:30
(1 day ago)
35.189.253.163 - - [21/Oct/2026:18:54:27 +0200] "GET /.ssh/id_dsa HTTP/2.0" 403 299 "-" "Mozilla/5.0 ...
show more
35.189.253.163 - - [21/Oct/2026:18:54:27 +0200] "GET /.ssh/id_dsa HTTP/2.0" 403 299 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email])"
35.189.253.163 - - [21/Oct/2026:18:54:27 +0200] "GET /id_ed25519 HTTP/2.0" 307 378 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
35.189.253.163 - - [21/Oct/2026:18:54:27 +0200] "GET /.ssh/authorized_keys HTTP/2.0" 403 299 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.189.253.163 - - [21/Oct/2026:18:54:27 +0200] "GET /host.key HTTP/2.0" 307 375 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.189.253.163 - - [21/Oct/2026:18:54:27 +0200] "GET /id_ecdsa HTTP/2.0" 307 374 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
35.189.253.163 - - [21/Oct/2026:18:54:27 +0200] "GET
show less
Web App Attack
Hacking
🇸🇪
vaia.cloud
2026-10-21 16:50:02
(1 day ago)
crowdsecurity/grafana-cve-2021-43798
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-21 16:48:34
(1 day ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
relianoid.com
2026-10-21 16:47:30
(1 day ago)
404 Errors Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web App Attack
🇬🇧
consul.to
2026-10-21 16:45:31
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
COMAITE
2026-10-21 16:31:56
(1 day ago)
Common web attack from 35.189.253.163.
Web App Attack