🇦🇺
CalmBrain
2026-11-07 16:01:03
UTC ·
(1 hour ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-crawl-non_statics
Web App Attack
Bad Web Bot
🇳🇦
jacqueskruger
2026-11-07 13:14:13
UTC ·
(4 hours ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-06T20:34:07Z. Evidence: repeated distinct requests matchin ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-06T20:34:07Z. Evidence: repeated distinct requests matching our high-confidence scanner rules.
show less
Bad Web Bot
🇬🇧
openstrike.co.uk
2026-11-07 06:16:33
UTC ·
(11 hours ago)
210 attacks on PHP URLs, VC URLs, env grabbing URLs, config grabbing URLs (type 2), directory traversals, password/key grabbing URLs, env grabbing URLs (type 2):
GET /laravel../config/database.php HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /cache/original/ ...
show more
210 attacks on PHP URLs, VC URLs, env grabbing URLs, config grabbing URLs (type 2), directory traversals, password/key grabbing URLs, env grabbing URLs (type 2):
GET /laravel../config/database.php HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /cache/original/%2e%2e/%2e%2e/.env HTTP/1.1
GET /secrets.yml HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /.git-credentials HTTP/1.1
GET /proc/self/environ%3F.js HTTP/1.1
show less
Web App Attack
Hacking
🇳🇱
homeshowdomain.nl
2026-11-06 22:59:22
UTC ·
(18 hours ago)
Auto-ban: >3000 req/min op 2026-11-06
Web App Attack
SSH
Hacking
🇩🇪
maxpower
2026-11-06 21:34:20
UTC ·
(20 hours ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 35.204.13.223 (NL/The Netherlands/223.13.204.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.204.13.223 - - [06/Nov/202 ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 35.204.13.223 (NL/The Netherlands/223.13.204.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.204.13.223 - - [06/Nov/2026:22:34:15 +0100] "GET /config.env HTTP/2.0" 429 41 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)" "192.168.176.79" host=mail.spacehosting.ovh
show less
Port Scan
🇳🇱
Savvii
2026-11-06 19:18:16
UTC ·
(22 hours ago)
20 attempts against mh-misbehave-ban on sedna
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-11-06 19:10:10
UTC ·
(22 hours ago)
Web App Attack
🇵🇷
HRCOM
2026-11-06 19:09:47
UTC ·
(22 hours ago)
Web attack: probing for sensitive files with path traversal / file inclusion attempts. 5 malicious requests (14 in total) between 2026-11-06 19:09:44 UTC and 2026-11-06 19:09:48 UTC. Examples: GET /.env.supabase; GET /api/console/api_server?sense_ver ...
show more
Web attack: probing for sensitive files with path traversal / file inclusion attempts. 5 malicious requests (14 in total) between 2026-11-06 19:09:44 UTC and 2026-11-06 19:09:48 UTC. Examples: GET /.env.supabase; GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ; GET /api/attachments/img/avatar/..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron; GET /.env.monorepo; GET /static/../../../a/../../../../proc/self/environ. Attack requests answered 302 x3, 404 x1, 400 x1; no file was disclosed. User-Agent claims to be Applebot, but reverse DNS of the IP does not belong to Applebot (spoofed crawler). Rotated 10 different User-Agent strings during the attack. Burst of 10+ requests at 2+ per second. Target: web server (HTTPS). Blocked automatically after repeated requests for sensitive files.
show less
Web App Attack
Hacking
Bad Web Bot
🇫🇮
pixiekat
2026-11-06 19:05:15
UTC ·
(22 hours ago)
Banned by fail2ban (apache-modsecurity, 3 hits) [msg "Next.js middleware-bypass probe blocked (CVE-2025-29927, no Next.js apps on this server)"]
Web App Attack
🇦🇺
aranguren.org
2026-11-06 18:17:11
UTC ·
(23 hours ago)
35.204.13.223 - - [07/Nov/2026:05:17:09 +1100] "GET / HTTP/2.0" 400 13598 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36"
35.204.13.223 - - [07/Nov/2026:05:17:10 +1100] "GET /sitem ...
show more
35.204.13.223 - - [07/Nov/2026:05:17:09 +1100] "GET / HTTP/2.0" 400 13598 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36"
35.204.13.223 - - [07/Nov/2026:05:17:10 +1100] "GET /sitemap.xml HTTP/2.0" 404 995 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.204.13.223 - - [07/Nov/2026:05:17:11 +1100] "GET /sitemap_index.xml HTTP/2.0" 404 995 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
...
show less
Bad Web Bot
🇳🇱
ConsulHosting
2026-11-06 17:17:00
UTC ·
(1 day ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇫🇷
Jimbo67
2026-11-06 17:10:48
UTC ·
(1 day ago)
Cloudflare WAF: 49 hits in 30s | action=block | abuse=suspicious_probe | categories=19,21 | rule_id=3329c9d804134f3e89780d69bfd872dc | URIs=/*.auto.tfvars,/.aws/credentials%3F.txt,/.docker/secrets.json,/.env%3F.css,/.env.backup | confidence=0.89
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-11-06 16:37:00
UTC ·
(1 day ago)
IPBlock protected site ID [3390-wh].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-11-06 15:13:47
UTC ·
(1 day ago)
20 attempts against mh-misbehave-ban on lunar
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-06 14:59:24
UTC ·
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
