🇧🇷
ICS Labs
2026-10-14 15:19:28
(2 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-10-14 UTC.
Brute-Force
Exploited Host
🇳🇱
Site.eu
2026-10-14 01:10:01
(2 days ago)
Excessive multi-domain requests
Brute-Force
2026-10-13 20:38:43
(3 days ago)
35.253.66.111 - - [13/Oct/2026:20:38:43 +0000] "GET /uploads../.env HTTP/2.0" 302 322 "-" "Mozilla/5 ...
show more
35.253.66.111 - - [13/Oct/2026:20:38:43 +0000] "GET /uploads../.env HTTP/2.0" 302 322 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-10-13 17:20:07
(3 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-10-13 17:07:20
(3 days ago)
35.253.66.111 - - [13/Oct/2026:19:07:15 +0200] "GET /api/fs/read?allowOutsideWorkspace=true&path=/pr ...
show more
35.253.66.111 - - [13/Oct/2026:19:07:15 +0200] "GET /api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ HTTP/2.0" 404 297 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.253.66.111 - - [13/Oct/2026:19:07:15 +0200] "GET /userfiles?path=../../../../proc/self/environ HTTP/2.0" 403 299 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
35.253.66.111 - - [13/Oct/2026:19:07:15 +0200] "GET /compose.yml HTTP/2.0" 403 299 "-" "Mozilla/5.0 (compatible; Bytespider; [email]) AppleWebKit/537.36"
35.253.66.111 - - [13/Oct/2026:19:07:15 +0200] "GET /.npmrc HTTP/2.0" 404 297 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.253.66.111 - - [13/Oct/2026:19:07:15 +0200] "GET /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ HTTP/2.0" 400 327 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
35.2
show less
Bad Web Bot
🇩🇪
onlyops.app
2026-10-13 16:00:19
(3 days ago)
Web application firewall (ModSecurity) detected malicious traffic | detected by Fail2Ban (plesk-mods ...
show more
Web application firewall (ModSecurity) detected malicious traffic | detected by Fail2Ban (plesk-modsecurity jail) | onlyops.app
show less
Exploited Host
🇯🇵
amyriad
2026-10-13 13:03:19
(3 days ago)
35.253.66.111 - - [13/Oct/2026:13:03:18 +0000] "GET /js../.env HTTP/1.1" 404 196 "-" "DuckAssistBot/ ...
show more
35.253.66.111 - - [13/Oct/2026:13:03:18 +0000] "GET /js../.env HTTP/1.1" 404 196 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.253.66.111 - - [13/Oct/2026:13:03:18 +0000] "GET /img../.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
35.253.66.111 - - [13/Oct/2026:13:03:18 +0000] "GET /images../.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
DDoS Attack
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-10-13 11:49:57
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.253.66.111 (111.66.253.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.253.66.111 (111.66.253.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:49:52.186493 2026] [security2:error] [pid 28269:tid 28272] [client 35.253.66.111:43672] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.marinkovich.name"] [uri "/files../.env"] [unique_id "as4a4ANZQmVG3uwLTu2N-gAAAME"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-13 10:43:49
(3 days ago)
Excessive 404/403 errors
Brute-Force
🇦🇹
mindrider
2026-10-13 10:25:17
(3 days ago)
35.253.66.111 - - [13/Oct/2026:12:25:15 +0200] "GET /media../.env HTTP/1.1" 404 2968 "-" "Mozilla/5. ...
show more
35.253.66.111 - - [13/Oct/2026:12:25:15 +0200] "GET /media../.env HTTP/1.1" 404 2968 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-"
35.253.66.111 - - [13/Oct/2026:12:25:15 +0200] "GET /images../.env HTTP/1.1" 404 2968 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)" "-"
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 09:56:55
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.253.66.111 (111.66.253.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.253.66.111 (111.66.253.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:56:50.530389 2026] [security2:error] [pid 23910:tid 23910] [client 35.253.66.111:57956] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "volkerjahn.name"] [uri "/.env.supabase"] [unique_id "as4AYkZCNUfA1ot24DEO2gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-13 09:55:56
(3 days ago)
{"level":"info","ts":1791885355.2098272,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791885355.2098272,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.253.66.111","remote_port":"57534","client_ip":"35.253.66.111","proto":"HTTP/2.0","method":"GET","host":"status.flow.bio","uri":"/dist/manifest.json","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Fetch-User":["?1"],"Sec-Fetch-Mode":["navigate"],"X-Nextjs-Data":["1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Priority":["u=0, i"],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Fetch-Dest":["document"],"Sec-Ch-Ua-Platform":["\"Linux\""],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Accept-Encoding":["gzip, deflate, br, zstd"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safar
...
show less
DDoS Attack
Web App Attack
🇬🇧
oja
2026-10-13 09:34:29
(3 days ago)
Aggressive web scanner
Web App Attack
🇬🇧
consul.to
2026-10-13 09:31:09
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 09:28:51
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.253.66.111 (111.66.253.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.253.66.111 (111.66.253.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 05:28:43.223970 2026] [security2:error] [pid 13919:tid 13919] [client 35.253.66.111:59192] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.alknetso.name"] [uri "/files../.env"] [unique_id "as35y3Aipttmlw4ILH2HxwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack