🇭🇺
miszterx.hu
2026-11-12 07:21:27
UTC ·
(19 hours ago)
XORP (haproxy): 73x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu)
Web App Attack
🇳🇱
Alt255
2026-11-12 07:16:18
UTC ·
(19 hours ago)
[cb17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 8.235.78.233 - - [12/Nov/2026:08:16:10 +0100] "GET /.git/config HTTP/2.0" 404 124346 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 ...
show more
[cb17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 8.235.78.233 - - [12/Nov/2026:08:16:10 +0100] "GET /.git/config HTTP/2.0" 404 124346 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇦🇹
SchiWaGoA
2026-11-12 02:54:31
UTC ·
(1 day ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
Anonymous
2026-11-10 02:22:08
UTC ·
(3 days ago)
CrowdSec detection: crowdsecurity/http-sensitive-files
Web App Attack
🇦🇹
Pingger Shikkoken
2026-11-09 20:29:10
UTC ·
(3 days ago)
2026-11-09T20:29:10+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=8.235.78.233 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x60 TTL=55 ID=24979 DF PROTO=TCP SPT=34994 DPT=443 WIND ...
show more
2026-11-09T20:29:10+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=8.235.78.233 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x60 TTL=55 ID=24979 DF PROTO=TCP SPT=34994 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0 2026-11-09T20:29:11+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=8.235.78.233 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x60 TTL=55 ID=24980 DF PROTO=TCP SPT=34994 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0 2026-11-09T20:29:12+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=8.235.78.233 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x60 TTL=55 ID=24981 DF PROTO=TCP SPT=34994 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0
show less
Hacking
Bad Web Bot
🇰🇷
fanbinit
2026-11-09 16:41:13
UTC ·
(3 days ago)
Repeated requests for sensitive configuration or repository paths.
Web App Attack
🇫🇷
masterguru
2026-11-09 15:37:03
UTC ·
(3 days ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
Anonymous
2026-11-09 14:20:21
UTC ·
(3 days ago)
Web attack blocked by WAF: GET /phpinfo.php.bak, GET /phpinfo.php.old, GET /phpinfo.php~ (Bad file extension; Possible enumeration of sensitive data (dirb)).
[09/Nov/2026:17:20:18 +0300] "GET /phpinfo.php.bak HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Int ...
show more
Web attack blocked by WAF: GET /phpinfo.php.bak, GET /phpinfo.php.old, GET /phpinfo.php~ (Bad file extension; Possible enumeration of sensitive data (dirb)).
[09/Nov/2026:17:20:18 +0300] "GET /phpinfo.php.bak HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like " -> Bad file extension
[09/Nov/2026:17:20:18 +0300] "GET /phpinfo.php.old HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like " -> Bad file extension
[09/Nov/2026:17:20:19 +0300] "GET /phpinfo.php~ HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like " -> Possible enumeration of sensitive data (dirb)
[09/Nov/2026:17:20:20 +0300] "GET /info.php.bak HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like " -> Bad file extension
show less
Web App Attack
🇦🇹
SchiWaGoA
2026-11-09 11:59:43
UTC ·
(3 days ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
Anonymous
2026-11-09 09:09:57
UTC ·
(3 days ago)
8.235.78.233 - - [09/Nov/2026:01:48:31 -0600] "GET /.env HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 8.235.78.233
8.235.78.233 - - [09/Nov/2026:01:48:32 -0600 ...
show more
8.235.78.233 - - [09/Nov/2026:01:48:31 -0600] "GET /.env HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 8.235.78.233
8.235.78.233 - - [09/Nov/2026:01:48:32 -0600] "GET /.env.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 8.235.78.233
8.235.78.233 - - [09/Nov/2026:01:48:32 -0600] "GET /.env.production HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 8.235.78.233
8.235.78.233 - - [09/Nov/2026:01:48:32 -0600] "GET /.env.staging HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 8.235.78.233
8.235.78.233 - - [09/Nov/2026:01:48:32 -0600] "GET /.env.development HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
...
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-09 04:14:52
UTC ·
(3 days ago)
8.235.78.233 - - [09/Nov/2026:12:14:46 +0800] "GET /phpinfo.php HTTP/1.1" 404 26371 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
8.235.78.233 - - [09/Nov/2026:12:14:46 +08 ...
show more
8.235.78.233 - - [09/Nov/2026:12:14:46 +0800] "GET /phpinfo.php HTTP/1.1" 404 26371 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
8.235.78.233 - - [09/Nov/2026:12:14:46 +0800] "GET /php.php HTTP/1.1" 404 26371 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
8.235.78.233 - - [09/Nov/2026:12:14:47 +0800] "GET /i.php HTTP/1.1" 404 26371 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
8.235.78.233 - - [09/Nov/2026:12:14:48 +0800] "GET /pi.php HTTP/1.1" 404 26371 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
8.235.78.233 - - [09/Nov/2026:12:14:48 +0800] "GET /pinfo.php HTTP/1.1" 404 26371 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/13
...
show less
Bad Web Bot
Web App Attack
🇫🇮
6kilowatti
2026-11-08 21:37:38
UTC ·
(4 days ago)
[08/Nov/2026:21:37:35 +0000] - 404 404 - GET https ysf.oh6ah.fi "/.git/config" [Client 8.235.78.233] [Length 242] [Gzip 1.19] [Sent-to 10.144.0.10] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Saf ...
show more
[08/Nov/2026:21:37:35 +0000] - 404 404 - GET https ysf.oh6ah.fi "/.git/config" [Client 8.235.78.233] [Length 242] [Gzip 1.19] [Sent-to 10.144.0.10] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
[08/Nov/2026:21:37:38 +0000] - 404 404 - GET https ysf.oh6ah.fi "/.env" [Client 8.235.78.233] [Length 242] [Gzip 1.19] [Sent-to 10.144.0.10] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
...
show less
Web App Attack
🇨🇭
dalslab ltd
2026-11-08 20:11:03
UTC ·
(4 days ago)
[08/Nov/2026:21:10:53 +0100] - 405 405 - POST https ys.dalslab.com "/" [Client 8.235.78.233] [Length 552] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537 ...
show more
[08/Nov/2026:21:10:53 +0100] - 405 405 - POST https ys.dalslab.com "/" [Client 8.235.78.233] [Length 552] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
[08/Nov/2026:21:10:53 +0100] - 405 405 - POST https ys.dalslab.com "/" [Client 8.235.78.233] [Length 552] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
[08/Nov/2026:21:10:54 +0100] - 405 405 - POST https ys.dalslab.com "/" [Client 8.235.78.233] [Length 552] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-"
[08/Nov/2026:21:10:54 +0100] - 405 405 - POST https ys.dalslab.com "/" [Client 8.235.78.233] [Length 552] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Web Spam
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-11-08 18:19:36
UTC ·
(4 days ago)
CrowdSec detection: crowdsecurity/http-sensitive-files
Web App Attack
🇫🇷
ELYAZ
2026-11-08 18:18:30
UTC ·
(4 days ago)
(credential-hunter) Failed credential-hunter trigger with match [redacted] from 8.235.78.233 (US/United States/233.78.235.8.bc.googleusercontent.com): (CF_ENABLE)
Hacking