🇳🇦
jacqueskruger
2026-11-06 16:31:09
UTC ·
(20 hours ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-05T23:55:22Z. Evidence: repeated distinct requests matchin ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-05T23:55:22Z. Evidence: repeated distinct requests matching our high-confidence scanner rules.
show less
Bad Web Bot
🇩🇪
altenglaner
2026-11-06 09:43:19
UTC ·
(1 day ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇧🇪
cmbplf
2026-11-06 09:42:31
UTC ·
(1 day ago)
137 requests with url.path */proc/*
Brute-Force
Bad Web Bot
2026-11-06 08:31:47
UTC ·
(1 day ago)
Web application attack: http cve 2021 41773; Web application attack: http path traversal probing; Probing for exposed secret / credential files; Web application attack: http sensitive files
Hacking
Web App Attack
🇩🇪
33three
2026-11-06 08:20:03
UTC ·
(1 day ago)
Fail2Ban jail WebAttack triggered
Brute-Force
🇳🇱
Alt255
2026-11-06 08:13:17
UTC ·
(1 day ago)
[cb-05al] Web exploit scanning: 5 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.245.190.58 - - [06/Nov/2026:09:13:10 +0100] "GET /.env.test HTTP/2.0" 404 1856 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
...
show more
[cb-05al] Web exploit scanning: 5 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.245.190.58 - - [06/Nov/2026:09:13:10 +0100] "GET /.env.test HTTP/2.0" 404 1856 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-11-06 08:12:14
UTC ·
(1 day ago)
(badbots) Bad bot user-agent [redacted] from 35.245.190.58 (US/United States/58.190.245.35.bc.googleusercontent.com)
Hacking
🇧🇷
dermatovirtual
2026-11-06 06:00:47
UTC ·
(1 day ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 65 unauthorized requests recorded between 2026-11-06 04:31:07 UTC and 2026-11-06 04:31:15 UTC (rate: ~65 req/min). Edge perimete ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 65 unauthorized requests recorded between 2026-11-06 04:31:07 UTC and 2026-11-06 04:31:15 UTC (rate: ~65 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-11-06 04:31:14 UTC] IP: 35.245.190.58 - W3C IIS (Port 443): GET /.env.dev.local -> HTTP 404 [CLIENT: 35.245.190.58]
[2026-11-06 04:31:14 UTC] IP: 35.245.190.58 - W3C IIS (Port 443): GET /.env.preprod -> HTTP 404 [CLIENT: 35.245.190.58]
[2026-11-06 04:31:15 UTC] IP: 35.245.190.58 - W3C IIS (Port 443): GET /.env.staging.local -> HTTP 404 [CLIENT: 35.245.190.58]
show less
Bad Web Bot
Web App Attack
🇪🇸
loadsoporte
2026-11-06 05:09:27
UTC ·
(1 day ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇩🇪
big-cloud.nl
2026-11-06 02:27:40
UTC ·
(1 day ago)
Try to access /.aws/credentials%3F.txt
Web App Attack
🇺🇸
jormaster3k
2026-11-06 01:49:48
UTC ·
(1 day ago)
Attack against Apache (too many 404s)
Web App Attack
🇩🇪
LRob
2026-11-06 01:32:31
UTC ·
(1 day ago)
Wordlist path sweep | method: GET | path: /885qrwmztz9is8xtcbho, /hpg2jtrdzd7dtuj5gz4g, /ngsw.json | ua: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot, Mozilla/5.0 AppleWebKit/537.36 (KHTML, li ...
show more
Wordlist path sweep | method: GET | path: /885qrwmztz9is8xtcbho, /hpg2jtrdzd7dtuj5gz4g, /ngsw.json | ua: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot, Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] ), Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
show less
Port Scan
Web App Attack
🇩🇪
Philister11
2026-11-06 01:10:32
UTC ·
(1 day ago)
CrowdSec: crowdsecurity/http-crawl-non_statics (US/AS396982)
Bad Web Bot
Web App Attack
2026-11-06 01:06:33
UTC ·
(1 day ago)
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.credentials HTTP/1.1" 429 227 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 35.245.190.58
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.staging.local HTTP/1.1" 403 199 "-" "Mozill ...
show more
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.credentials HTTP/1.1" 429 227 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 35.245.190.58
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.staging.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" 35.245.190.58
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.secret HTTP/1.1" 429 227 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 35.245.190.58
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.development.local HTTP/1.1" 403 199 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" 35.245.190.58
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.production.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" 35.245.190.58
35.245.190.58 - - [05/Nov/2026:19:06:31 -0600] "GET /.env.dev.local HTTP/1.1" 429 227 "-" "Mozilla/5.0 AppleWebKit/537.36 (KH
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Philister11
2026-11-06 00:03:41
UTC ·
(1 day ago)
CrowdSec: crowdsecurity/http-probing (US/AS396982)
Web App Attack
Hacking
