🇬🇧
openstrike.co.uk
2026-09-30 05:14:33
(14 hours ago)
137 attacks on VC URLs, env grabbing URLs (type 2), env grabbing URLs, PHP URLs, config grabbing URL ...
show more
137 attacks on VC URLs, env grabbing URLs (type 2), env grabbing URLs, PHP URLs, config grabbing URLs (type 2), password/key grabbing URLs, shell probes, directory traversals:
GET /.git/HEAD HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///proc/self/environ&environmentName=rsc HTTP/1.1
GET /.env.test HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /config/storage.yml HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
show less
Hacking
Web App Attack
2026-09-30 04:15:17
(15 hours ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:23:04
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.221.87.81 (81.87.221.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.87.81 (81.87.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:23:01.574183 2026] [security2:error] [pid 4131:tid 4131] [client 35.221.87.81:35816] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "moonlightmotel.com"] [uri "/.env.php.bak"] [unique_id "arxkdYzdmoMs35fVrV6flAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 00:21:18
(19 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.221.87.81 (81.87.221.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.87.81 (81.87.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 20:21:13.818858 2026] [security2:error] [pid 16102:tid 16102] [client 35.221.87.81:36128] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||moonfamilies.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "moonfamilies.com"] [uri "/z9x8c7v6b5-debug-trigger-moonfamilies.com"] [unique_id "arxV-R8yz_8aLfrXC1uczgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-30 00:06:46
(19 hours ago)
2.199 requests from abuseipdb.com blacklisted IP (4mos2w2d)
Brute-Force
Bad Web Bot
🇺🇸
dot.mg
2026-09-29 23:45:02
(19 hours ago)
Bad behaviour
Web Spam
🇳🇱
Site.eu
2026-09-29 22:40:06
(21 hours ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-09-29 22:37:25
(21 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
🇧🇷
radardatelecom
2026-09-29 22:26:04
(21 hours ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇭🇳
soporte
2026-09-29 21:41:01
(22 hours ago)
Probe for vulnerabilities. Path attempted: /actuator/gateway/routes
Web App Attack
🇳🇱
Savvii
2026-09-29 21:26:33
(22 hours ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 20:29:43
(23 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.221.87.81 (81.87.221.35.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 35.221.87.81 (81.87.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 16:29:38.804460 2026] [security2:error] [pid 14789:tid 14789] [client 35.221.87.81:44514] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mosherpit.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mosherpit.com"] [uri "/z9x8c7v6b5-debug-trigger-mosherpit.com"] [unique_id "arwfsktAeG_DVrMVOddEFgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-29 20:15:06
(23 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇦
URAN Publishing Service
2026-09-29 20:14:55
(23 hours ago)
[29/Sep/2026:23:14:55 +0300] -- 35.221.87.81 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /a ...
show more
[29/Sep/2026:23:14:55 +0300] -- 35.221.87.81 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /assets/manifest.json HTTP/1.1
show less
Bad Web Bot
Web App Attack
2026-09-29 20:08:51
(23 hours ago)
Portscan: TCP/8443 (4x), TCP/8080 (4x)
Port Scan