2026-09-22 08:51:47
(5 hours ago)
(caddyscan) Scanner path probe from 45.138.12.44 (GB/United Kingdom/-): 5 in the last 3600 secs; Por ...
show more
(caddyscan) Scanner path probe from 45.138.12.44 (GB/United Kingdom/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:08:51:45 +0000] "GET /..%ef%bc%8fvar/www/html/.git/config?_=p2rzng0j&v=4axbo HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:08:51:45 +0000] "GET /..%ef%bc%8fvar/www/.git/config?_=cthwfhmk&v=vme8e HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:08:51:46 +0000] "GET /..%ef%bc%8froot/.ssh/id_rsa?_=2t2ukzg5&v=1iihy HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:08:51:46 +0000] "GET /..%ef%bc%8froot/.ssh/id_ed25519?_=qmzy4bl3&v=82dml HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:08:51:46 +0000] "GET /..%ef%bc%8fhome/ubuntu/.ssh/id_rsa?_=vgayitx4&v=a6dil HTTP/1.1"
show less
Port Scan
2026-09-22 07:51:36
(6 hours ago)
(caddyscan) Scanner path probe from 45.138.12.44 (GB/United Kingdom/-): 5 in the last 3600 secs; Por ...
show more
(caddyscan) Scanner path probe from 45.138.12.44 (GB/United Kingdom/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 400 344 45.138.12.44 - - [22/Sep/2026:07:51:33 +0000] "GET /%2e%2e/%2e%2e/home/ec2-user/.ssh/id_rsa?_=81tfu41n&v=7v3o3 HTTP/1.1"
[REDACTED] 400 344 45.138.12.44 - - [22/Sep/2026:07:51:34 +0000] "GET /%2e%2e/%2e%2e/home/www-data/.ssh/id_rsa?_=vwfw49vw&v=vzj1g HTTP/1.1"
[REDACTED] 400 344 45.138.12.44 - - [22/Sep/2026:07:51:34 +0000] "GET /%2e%2e/%2e%2e/home/git/.ssh/id_rsa?_=fax3vn27&v=273ws HTTP/1.1"
[REDACTED] 400 344 45.138.12.44 - - [22/Sep/2026:07:51:34 +0000] "GET /%2e%2e/%2e%2e/home/admin/.ssh/id_rsa?_=v6vdvysa&v=om36m HTTP/1.1"
[REDACTED] 400 344 45.138.12.44 - - [22/Sep/2026:07:51:35 +0000] "GET /%2e%2e/%2e%2e/%2e%2e/.aws/credentials?_=w76cv68w&v=733xp HTTP/1.1"
show less
Port Scan
2026-09-22 06:51:15
(7 hours ago)
(caddyscan) Scanner path probe from 45.138.12.44 (GB/United Kingdom/-): 5 in the last 3600 secs; Por ...
show more
(caddyscan) Scanner path probe from 45.138.12.44 (GB/United Kingdom/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:06:51:13 +0000] "GET /.env?_=acz9oacv&v=gdd1z HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:06:51:13 +0000] "GET /.env.local?_=vc4p6hka&v=76mob HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:06:51:14 +0000] "GET /.env.production?_=kost7k8j&v=qtbxu HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:06:51:14 +0000] "GET /.env.development?_=g4wqrgmy&v=zogj3 HTTP/1.1"
[REDACTED] 200 2627 45.138.12.44 - - [22/Sep/2026:06:51:14 +0000] "GET /.env.staging?_=r1pzda2a&v=z9qi1 HTTP/1.1"
show less
Port Scan
🇺🇸
dot.mg
2026-09-22 06:41:14
(7 hours ago)
Bad behaviour
Web Spam
🇩🇪
Tsumugi Kotobuki
2026-09-22 05:37:31
(8 hours ago)
Web Scan (L7) | Paths: /.env?[redacted-query] | Codes: 444(1x) | UA: Mozilla/5.0 (Linux; Android 14; ...
show more
Web Scan (L7) | Paths: /.env?[redacted-query] | Codes: 444(1x) | UA: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/... | F2B/angie-honeypot@2026-09-22T05:37:31Z
show less
Bad Web Bot
Web App Attack
Hacking
🇬🇧
openstrike.co.uk
2026-09-22 05:14:28
(9 hours ago)
420 attacks on PHP URLs, password/key grabbing URLs, env grabbing URLs (type 2), directory traversal ...
show more
420 attacks on PHP URLs, password/key grabbing URLs, env grabbing URLs (type 2), directory traversals, env grabbing URLs:
GET /wp-config.php?_=l36hyfu0&v=epkmk HTTP/1.1
GET /../../../../etc/passwd?_=xks70pb2&v=ld7rh HTTP/1.1
GET /....//....//....//....//....//proc/self/cmdline?_=slqavqcb&v=k8g6z HTTP/1.1
GET /..%5c..%5c..%5cetc%5cpasswd?_=1hp9xbt4&v=hu3jz HTTP/1.1
GET https://l3.org.uk/%%32e%%32e/%%32e%%32e/.env?_=2jf8mezi&v=lgco7 HTTP/1.1
show less
Web App Attack
Hacking
2026-09-22 04:51:04
(9 hours ago)
Web application attack detected.
Web App Attack
🇬🇧
consul.to
2026-09-22 01:24:39
(12 hours ago)
Web attack/malicious scanning detected
Web App Attack
2026-09-22 01:07:02
(13 hours ago)
Bot / scanning and/or hacking attempts: GET /.env.staging?_=xp23lsdg&v=eavnm HTTP/1.1, GET /.env ...
show more
Bot / scanning and/or hacking attempts: GET /.env.staging?_=xp23lsdg&v=eavnm HTTP/1.1, GET /.env.development?_=oa7w104g&v=rhkdf HTTP/1.1, GET /.env?_=1oyumi09&v=gbixa HTTP/1.1, GET /?_=8uhhxlav&v=t6shp HTTP/1.1, GET /?_=bey9uvtl&v=y696n HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
shadowgaming
2026-09-21 19:22:10
(19 hours ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /%09/.env.local | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇧🇪
cmbplf
2026-09-21 19:03:41
(19 hours ago)
745 requests with url.path *.ssh/*
157 requests with url.path *config.php
Brute-Force
Bad Web Bot
🇿🇦
conure.sh
2026-09-21 15:02:43
(23 hours ago)
csagent: score 20.2: secrets grab x2, 404 noise floor x1; 1 domain(s) in 1s
Web App Attack
2026-09-21 14:15:01
(1 day ago)
suspicious request in access.log
Web App Attack
🇳🇱
ConsulHosting
2026-09-21 11:34:35
(1 day ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇿🇦
conure.sh
2026-09-21 11:01:43
(1 day ago)
csagent: score 16.9: secrets grab x2, 404 noise floor x2; 1 domain(s) in 1m20s
Web App Attack
