2026-10-28 06:05:08
(15 hours ago)
Web probing (680 hits in 24h) on default-vhost,files.yko.nl: sensitive-path scans and/or 404 bursts. Reported by CRMON.
Web App Attack
🇳🇱
Alt255
2026-10-28 05:59:05
(15 hours ago)
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.246.206.85 - - [28/Oct/2026:06:58:57 +0100] "GET /.env.supabase HTTP/1.1" 404 2070 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +http ...
show more
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.246.206.85 - - [28/Oct/2026:06:58:57 +0100] "GET /.env.supabase HTTP/1.1" 404 2070 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Bad Web Bot
Web App Attack
2026-10-28 05:55:38
(15 hours ago)
Web application attack: grafana cve 2021 43798; Web application attack: http sensitive files; Web application attack: http path traversal probing; Web application attack: http cve 2021 41773; Probing for exposed secret / credential files
Hacking
Web App Attack
🇩🇰
SaltySoftworks
2026-10-28 02:27:39
(19 hours ago)
User agent spoofing
Spoofing
🇩🇪
updown.io
2026-10-28 02:02:17
(19 hours ago)
{"level":"info","ts":1793152934.5501828,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.246.206.85","remote_port":"51784","client_ip":"35.246.206.85","proto":"HTTP/2.0","method":"GET","host":"status.skypaybd.top","u ...
show more
{"level":"info","ts":1793152934.5501828,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.246.206.85","remote_port":"51784","client_ip":"35.246.206.85","proto":"HTTP/2.0","method":"GET","host":"status.skypaybd.top","uri":"/webpack-stats.json","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Site":["none"],"Sec-Ch-Ua-Mobile":["?0"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Fetch-User":["?1"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""],"X-Nextjs-Data":["1"],"Priority":["u=0, i"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
...
show less
DDoS Attack
Web App Attack
2026-10-27 14:30:04
(1 day ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
2026-10-27 14:10:14
(1 day ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-10-27 04:52:57
(1 day ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇳🇱
Site.eu
2026-10-26 22:25:26
(1 day ago)
Excessive 404/403 errors
Brute-Force
🇳🇱
Alt255
2026-10-26 21:18:58
(2 days ago)
[ti-14al] Web exploit scanning: 4 suspicious requests detected by fail2ban jail <name>. Example: 35.246.206.85 - - [25/Oct/2026:21:20:51 +0100] "GET /@fs/app/.env.production?import&raw?? HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (compatible; Meta-WebIndexe ...
show more
[ti-14al] Web exploit scanning: 4 suspicious requests detected by fail2ban jail <name>. Example: 35.246.206.85 - - [25/Oct/2026:21:20:51 +0100] "GET /@fs/app/.env.production?import&raw?? HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.246.206.85 - - [25/Oct/2026:21:20:51 +0100] "GET /.env?import&raw HTTP/1.1" 404 3648 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
35.246.206.85 - - [25/Oct/2026:21:20:51 +0100] "GET /.env?raw HTTP/1.1" 404 2105 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
35.246.206.85 - - [25/Oct/2026:21:20:51 +0100] "GET /@fs/app/.env.local?import&raw?? HTTP/1.1" 404 3648 "-" "Mo
...
show less
Bad Web Bot
Web App Attack
🇫🇷
IRISIO
2026-10-26 16:16:47
(2 days ago)
scans/SQL injection/spam posts : 1697 queries
Web App Attack
SQL Injection
🇫🇷
IRISIO
2026-10-26 06:57:11
(2 days ago)
scans/SQL injection/spam posts : 1276 queries
Web App Attack
SQL Injection
🇳🇱
e.fierstra
2026-10-26 05:19:46
(2 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
Blamdom
2026-10-26 03:32:49
(2 days ago)
Secret/config-file recon: requested /.npmrc. 278 HTTP request(s), 2026-10-26 03:32:49 to 03:33:13 UTC (23s).
Requests (method path -> status xcount):
GET [site page] -> 301 x111
POST [site page] -> 301 x10
GET / -> 400 x7
POST /api/... -> 301 ...
show more
Secret/config-file recon: requested /.npmrc. 278 HTTP request(s), 2026-10-26 03:32:49 to 03:33:13 UTC (23s).
Requests (method path -> status xcount):
GET [site page] -> 301 x111
POST [site page] -> 301 x10
GET / -> 400 x7
POST /api/... -> 301 x6
POST / -> 301 x3
POST /_next/... -> 301 x2
GET /api/... -> 301 x2
GET / -> 301
...+136 more distinct requests
UA: Mozilla/5.0 (compatible; YouBot/1.0; +https://[redacted]/bot) (+32 other UAs)
show less
Hacking
Bad Web Bot
Web App Attack
2026-10-25 23:29:45
(2 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
