🇳🇱
homeshowdomain.nl
2026-10-15 22:06:38
(1 day ago)
Auto-ban: 235 malicious requests on 2026-10-14 (e.g., env/backup probes, brute-force, or error burst ...
show more
Auto-ban: 235 malicious requests on 2026-10-14 (e.g., env/backup probes, brute-force, or error bursts).
show less
Web App Attack
SSH
Hacking
🇬🇧
openstrike.co.uk
2026-10-15 05:16:14
(2 days ago)
226 attacks on VC URLs, PHP URLs, shell probes, directory traversals, env grabbing URLs, env grabbin ...
show more
226 attacks on VC URLs, PHP URLs, shell probes, directory traversals, env grabbing URLs, env grabbing URLs (type 2), password/key grabbing URLs, config grabbing URLs (type 2):
GET /.git/HEAD HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /..%2f.env HTTP/1.1
GET /config/.env.local HTTP/1.1
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /@fs/root/.aws/credentials?raw?? HTTP/1.1
GET /secrets.yml HTTP/1.1
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-14 21:59:50
(2 days ago)
Auto-ban: >3000 req/min op 2026-10-14
Web App Attack
SSH
Hacking
🇩🇪
ger-stg-sifi1
2026-10-14 20:32:36
(3 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇧🇪
cmbplf
2026-10-14 20:23:15
(3 days ago)
2.337 requests with url.path *.env
453 requests with url.path */@fs/*
229 requests with url.path ...
show more
2.337 requests with url.path *.env
453 requests with url.path */@fs/*
229 requests with url.path */proc/*
184 requests with url.path *credentials.json
127 requests with url.path *.ssh/*
show less
Brute-Force
Bad Web Bot
🇩🇪
ardexter
2026-10-14 20:22:28
(3 days ago)
Wordpress attack and DDOS
DDoS Attack
Web App Attack
2026-10-14 19:52:43
(3 days ago)
35.246.180.254 - - [14/Oct/2026:14:52:42 -0500] "GET /.env.credentials HTTP/1.1" 403 199 "-" "Mozill ...
show more
35.246.180.254 - - [14/Oct/2026:14:52:42 -0500] "GET /.env.credentials HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" 35.246.180.254
35.246.180.254 - - [14/Oct/2026:14:52:42 -0500] "GET /.env.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.246.180.254
35.246.180.254 - - [14/Oct/2026:14:52:42 -0500] "GET /.env.development?import&raw HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" 35.246.180.254
35.246.180.254 - - [14/Oct/2026:14:52:42 -0500] "GET /.env.backup HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" 35.246.180.254
35.246.180.254 - - [14/Oct/2026:14:52:42 -0500] "GET /.env.keys HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" 35.246.180.254
35.246.180.254 - - [14/Oct/2026:14:5
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-10-14 19:20:01
(3 days ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇳🇱
Site.eu
2026-10-14 19:05:12
(3 days ago)
Excessive 404/403 errors
Brute-Force
🇳🇱
Savvii
2026-10-14 16:51:00
(3 days ago)
20 attempts against mh-misbehave-ban on burne
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 16:20:53
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 35.246.180.254 (254.180.246.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.246.180.254 (254.180.246.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:20:47.569376 2026] [security2:error] [pid 24252:tid 24252] [client 35.246.180.254:43428] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.kronrod.com|F|2"] [data ".kronrod.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.kronrod.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.kronrod.com"] [unique_id "as-r3z5phtJJjGe0Gd09-gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
SSH-Admin
2026-10-14 15:43:59
(3 days ago)
Probing for Exploits on ns153
Exploited Host
Web App Attack
🇩🇪
arnisolutions
2026-10-14 12:47:55
(3 days ago)
Mass vulnerability scanning (LFI / path traversal probes with query parameters such as lokasie=/proc ...
show more
Mass vulnerability scanning (LFI / path traversal probes with query parameters such as lokasie=/proc/...) against a production server. Observed on 1 day(s) between 2026-10-14 and 2026-10-14 (UTC). Additional activity: badscanner. Sample request: POST /exec-py HTTP/2.0
show less
Web App Attack
Hacking
🇩🇪
big-cloud.nl
2026-10-14 11:14:31
(3 days ago)
Try to access /files../.env
Web App Attack
🇳🇱
Alt255
2026-10-14 10:29:00
(3 days ago)
[cb-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail ngin ...
show more
[cb-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 35.246.180.254 - - [14/Oct/2026:12:28:46 +0200] "POST /lib/terminal-xhr.php HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.246.180.254 - - [14/Oct/2026:12:28:46 +0200] "POST /icecoder/lib/terminal-xhr.php HTTP/2.0" 404 1338 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
35.246.180.254 - - [14/Oct/2026:12:28:50 +0200] "GET /in7fc6ywoligd2sqsb6i HTTP/2.0" 404 61652 "https://www.schmuck-herren.de/in7fc6ywoligd2sqsb6i" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
35.246.180.254 - - [14/Oct/2026:12:28:50 +0200] "GET /dvp5rtbnxgdvyq2vsjzb HTTP/2.0" 404 61655 "https://www.
...
show less
Bad Web Bot
Web App Attack