🇬🇧
openstrike.co.uk
2026-11-04 06:17:45
UTC ·
(1 week ago)
210 attacks on env grabbing URLs (type 2), env grabbing URLs, PHP URLs, VC URLs, directory traversals, config grabbing URLs (type 2), password/key grabbing URLs:
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /supabase/.env HTTP/1.1 ...
show more
210 attacks on env grabbing URLs (type 2), env grabbing URLs, PHP URLs, VC URLs, directory traversals, config grabbing URLs (type 2), password/key grabbing URLs:
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /supabase/.env HTTP/1.1
GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /..%2f.env HTTP/1.1
GET /config/environment.json HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-03 23:01:56
UTC ·
(1 week ago)
Auto-ban: >3000 req/min op 2026-11-03
Web App Attack
SSH
Hacking
🇧🇷
radardatelecom
2026-11-03 16:53:05
UTC ·
(1 week ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 15:24:31
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.246.141.149 (149.141.246.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 10:24:27.444305 2026] [security2:error] [pid 29062:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.246.141.149 (149.141.246.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 10:24:27.444305 2026] [security2:error] [pid 29062:tid 29062] [client 35.246.141.149:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.sportsbookcommission.com"] [uri "/apps/marketing/.env"] [unique_id "aun8q6JYXLxq5eZ4QV2KgAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-11-03 14:56:14
UTC ·
(1 week ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
SX Communications
2026-11-03 14:15:31
UTC ·
(1 week ago)
Web vulnerability scanning / probing from 35.246.141.149: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 59 hits; paths: /api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ, /a ...
show more
Web vulnerability scanning / probing from 35.246.141.149: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 59 hits; paths: /api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ, /api/system/fileView?file=/app/.env, /.env, /..../..../..../..../.env, /.changeset/config.json.
show less
Port Scan
Hacking
Web App Attack
🇺🇸
SX Communications
2026-11-03 14:15:31
UTC ·
(1 week ago)
HTTP application-layer DoS / botnet traffic from 35.246.141.149: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇪🇸
masterguru
2026-11-03 13:30:51
UTC ·
(1 week ago)
BAD BOT - Detected and Blocked.. Matched phrase "OAI-SearchBot" at REQUEST_HEADERS:User-Agent. (1100000-122)
Bad Web Bot
🇳🇱
Savvii
2026-11-03 12:55:23
UTC ·
(1 week ago)
20 attempts against mh-misbehave-ban on solar
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-03 12:51:09
UTC ·
(1 week ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-11-03 12:50:02
UTC ·
(1 week ago)
crowdsecurity/http-cve-2021-41773
Brute-Force
Web App Attack
2026-11-03 12:17:05
UTC ·
(1 week ago)
Bot / scanning and/or hacking attempts: GET /api/.env HTTP/2.0, GET /var/run/secrets/kubernetes.io/serviceaccount/token HTTP/2., GET /proc/self/cmdline HTTP/2.0, GET /.bash_profile HTTP/2.0, GET /.env.secret HTTP/2.0, GET /.firebaserc HTTP/2.0, GET / ...
show more
Bot / scanning and/or hacking attempts: GET /api/.env HTTP/2.0, GET /var/run/secrets/kubernetes.io/serviceaccount/token HTTP/2., GET /proc/self/cmdline HTTP/2.0, GET /.bash_profile HTTP/2.0, GET /.env.secret HTTP/2.0, GET /.firebaserc HTTP/2.0, GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env HTTP/2.0
show less
Hacking
Web App Attack
🇳🇱
middelkoopcc
2026-11-03 12:16:14
UTC ·
(1 week ago)
2026-11-03 13:14:12 GET /ngsw.json [404] && 2026-11-03 13:14:13 GET /public../.env [404] && 2026-11-03 13:14:13 GET /dist../.env [404] && 111 more within 20 minutes
Web App Attack
🇳🇱
Alt255
2026-11-03 12:09:11
UTC ·
(1 week ago)
[ti-30al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.246.141.149 - - [03/Nov/2026:13:08:57 +0100] "GET /u3guen3g5qt1sgwok40a HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; cohere-ai ...
show more
[ti-30al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.246.141.149 - - [03/Nov/2026:13:08:57 +0100] "GET /u3guen3g5qt1sgwok40a HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
35.246.141.149 - - [03/Nov/2026:13:08:57 +0100] "GET /z9x8c7v6b5-debug-trigger-pay.sparenbergdesign.com HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
35.246.141.149 - - [03/Nov/2026:13:08:57 +0100] "GET /udxtjq7s0xaelggijrm0 HTTP/2.0" 404 2020 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.246.141.149 - - [03/Nov/2026:13:08:57 +0100] "POST /graphql HTTP/2.0" 404 2020 "https://pay.sparenbergdesign.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/5
...
show less
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-03 11:44:37
UTC ·
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773
Web App Attack
Hacking
