🇬🇧
openstrike.co.uk
2026-10-13 05:16:12
(17 hours ago)
226 attacks on shell probes, password/key grabbing URLs, env grabbing URLs (type 2), PHP URLs, VC UR ...
show more
226 attacks on shell probes, password/key grabbing URLs, env grabbing URLs (type 2), PHP URLs, VC URLs, env grabbing URLs, directory traversals, config grabbing URLs (type 2):
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=rsc HTTP/1.1
GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /_image?href=/../../../.env HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /config/settings.local.yml HTTP/1.1
show less
Hacking
Web App Attack
🇲🇽
octageeks.com
2026-10-13 04:20:40
(18 hours ago)
Wordpress malicious attack:[octamissingdomain]
Web App Attack
2026-10-12 23:01:06
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇳🇱
homeshowdomain.nl
2026-10-12 22:01:03
(1 day ago)
Auto-ban: >3000 req/min op 2026-10-12
Web App Attack
SSH
Hacking
🇫🇮
Christopher Hughes
2026-10-12 21:50:51
(1 day ago)
35.203.0.230 - - [12/Oct/2026:22:50:50 +0100] "GET /.env.production.local HTTP/2.0" 200 1456 "-" "Mo ...
show more
35.203.0.230 - - [12/Oct/2026:22:50:50 +0100] "GET /.env.production.local HTTP/2.0" 200 1456 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
🇩🇪
rh24
2026-10-12 21:46:40
(1 day ago)
(badbots) Bad bot user-agent [redacted] from 35.203.0.230 (CA/Canada/230.0.203.35.bc.googleuserconte ...
show more
(badbots) Bad bot user-agent [redacted] from 35.203.0.230 (CA/Canada/230.0.203.35.bc.googleusercontent.com)
show less
Hacking
2026-10-12 20:18:35
(1 day ago)
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
🇨🇿
akac
2026-10-12 20:10:50
(1 day ago)
Web vulnerability scanning: HTTP/2 GET /console
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
deskpass.com
2026-10-12 19:06:22
(1 day ago)
POST /index.php
Web App Attack
2026-10-12 17:27:27
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
🇳🇱
Alt255
2026-10-12 17:03:03
(1 day ago)
[ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 35. ...
show more
[ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 35.203.0.230 - - \[12/Oct/2026:19:02:53 +0200\] "GET /build../.env HTTP/1.1" 403 2048 "-" "Mozilla/5.0 \(compatible\; Bravebot/1.0\; +https://brave.com/search/\)"
35.203.0.230 - - \[12/Oct/2026:19:02:53 +0200\] "GET /static/..\;/.env HTTP/1.1" 404 3612 "-" "Mozilla/5.0 \(compatible\; YouBot/1.0\; +https://you.com/bot\)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-12 16:55:18
(1 day ago)
20 attempts against mh-misbehave-ban on lunar
Brute-Force
Bad Web Bot
Web App Attack
2026-10-12 16:25:13
(1 day ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇫🇮
Christopher Hughes
2026-10-12 16:17:09
(1 day ago)
35.203.0.230 - - [12/Oct/2026:17:17:08 +0100] "GET /.env.supabase HTTP/2.0" 200 1456 "-" "Mozilla/5. ...
show more
35.203.0.230 - - [12/Oct/2026:17:17:08 +0100] "GET /.env.supabase HTTP/2.0" 200 1456 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 15:55:32
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.203.0.230 (230.0.203.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.203.0.230 (230.0.203.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 11:55:25.881511 2026] [security2:error] [pid 18077:tid 18077] [client 35.203.0.230:37220] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tmarketingproducts.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tmarketingproducts.com"] [uri "/z9x8c7v6b5-debug-trigger-tmarketingproducts.com"] [unique_id "as0C7XJdjvMrSttySYMtTAAAADI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
