🇩🇪
maxpower
2026-10-22 13:38:04
(2 hours ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 37.19.65.131 (US/United States/-): 1 in ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 37.19.65.131 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 37.19.65.131 - - [22/Oct/2026:15:37:59 +0200] "GET /secrets.yml HTTP/2.0" 508 288 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-" host=apstudiossd.it
show less
Port Scan
🇫🇷
vtchost.com
2026-10-22 07:51:03
(8 hours ago)
forbidden http request, scanning for weaknesses
...
Web App Attack
🇸🇪
vaia.cloud
2026-10-22 07:35:02
(8 hours ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 07:18:48
(9 hours ago)
(mod_security) mod_security (id:949110) triggered by 37.19.65.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:949110) triggered by 37.19.65.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 03:18:43.609870 2026] [security2:error] [pid 7950:tid 7950] [client 37.19.65.131:27441] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "armstrongenvironmental.com"] [uri "/.env"] [unique_id "atm40zGZxixtbgM_eAkougAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-22 05:30:56
(10 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: apm.teddypot.online | URI: /.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"37.19.65.131","Cdn-Loop":"cloudflare; loops=1","Sec-Fetch-Site":"none","Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/
show less
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-22 05:12:46
(11 hours ago)
Multiple WAF Violations
Web App Attack
🇳🇱
Alt255
2026-10-22 03:12:55
(13 hours ago)
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Examp ...
show more
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 37.19.65.131 - - [22/Oct/2026:05:12:36 +0200] "GET /.env HTTP/1.1" 404 2065 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 02:11:44
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 37.19.65.131 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 37.19.65.131 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 22:11:36.815028 2026] [security2:error] [pid 9468:tid 9468] [client 37.19.65.131:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "apenglishexamprep.com"] [uri "/.env"] [unique_id "atlw2IbrzEBFoEOcgiNtjAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-22 01:45:03
(14 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-10-22 00:28:58
(15 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
gamabe
2026-10-21 23:38:04
(16 hours ago)
Detected crowdsecurity/http-sensitive-files attack pattern. Reported by CrowdSec IDS.
Hacking
🇸🇪
vaia.cloud
2026-10-21 23:25:03
(17 hours ago)
crowdsecurity/http-cve-probing
Brute-Force
Web App Attack
2026-10-21 22:55:02
(17 hours ago)
suspicious request in access.log
Web App Attack
🇺🇸
Psycho Solutions LLC
2025-08-04 04:50:58
(1 year ago)
Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N ...
show more
Detected Wordpress Scanning. - Request Method: GET - Target: {PC} wp-login.php - User Agent: N/A - Timestamp: 8/4/2025 4:50 am (UTC-6)
show less
Web Spam
Hacking
Bad Web Bot
Web App Attack
2025-03-07 19:33:27
(1 year ago)
Infected user bad webscan
Exploited Host