|
Anonymous
|
|
IP matched detection query 50 and more bad rqs apache.
|
Hacking
Bad Web Bot
Brute-Force
Web App Attack
|
|
🇱🇹
NotACaptcha
|
|
webserver:443 [02/Nov/2026] "GET /server.key HTTP/1.1" 302 487 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
webserver:443 [02/Nov/2026] "GET /.env.config HTTP/1.1" 302 489 "-" "Mozilla ...
show more
webserver:443 [02/Nov/2026] "GET /server.key HTTP/1.1" 302 487 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
webserver:443 [02/Nov/2026] "GET /.env.config HTTP/1.1" 302 489 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
webserver:443 [02/Nov/2026] "GET /.env.testing HTTP/1.1" 302 491 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
webserver:443 [02/Nov/2026] "GET /.env.prod.local HTTP/1.1" 302 497 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
webserver:443 [02/Nov/2026] "GET /setcookie__en.html HTTP/1.1" 302 503 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
webserver:443 [02/Nov/2026] "GET /.env.preprod HTTP/1....
show less
|
Web App Attack
|
|
🇫🇷
✨
|
|
Domain : MailEnable WebMail
Rule : config
2026-11-02 13:57:59 ***hidden-privacy*** GET /.git/HEAD - 443 - 8.235.96.35 Mozilla/5.0 (compatible; YouBot/1.0; https://you.com/bot) - 404 8 0 1251 456 154 - -
|
Hacking
SQL Injection
|
|
Anonymous
|
|
IP matched detection query 404 icewarp.
|
Brute-Force
Hacking
|
|
🇱🇹
NotACaptcha
|
|
webserver:80 [02/Nov/2026] "GET /local_settings.py HTTP/1.1" 302 469 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
webserver:80 [02/Nov/2026] "GET /ai/.env HTTP/1.1" 302 449 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); ...
show more
webserver:80 [02/Nov/2026] "GET /local_settings.py HTTP/1.1" 302 469 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
webserver:80 [02/Nov/2026] "GET /ai/.env HTTP/1.1" 302 449 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
webserver:80 [02/Nov/2026] "GET /static//app/.env HTTP/1.1" 302 465 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])"
webserver:80 [02/Nov/2026] "GET /static../.env HTTP/1.1" 302 461 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
webserver:80 [02/Nov/2026] "GET /app/local_settings.py HTTP/1.1" 302 477 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
webserver:80 [02/Nov/2026] "GET /backend/settings.py HTTP/1.1" 302 473 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
webserver:80 [02/Nov/2026] "GET /instance/config.py HTTP...
show less
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 8.235.96.35 (35.96.235.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 04:37:52.804555 2026] [security2:error] [pid 29896:tid 2989 ...
show more
(mod_security) mod_security (id:210492) triggered by 8.235.96.35 (35.96.235.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 04:37:52.804555 2026] [security2:error] [pid 29896:tid 29896] [client 8.235.96.35:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nyemdr.org"] [uri "/.env.common"] [unique_id "auhZ8IhJNMvASrwV9Lu4sAAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
IP matched detection query bad paths many.
|
Brute-Force
Web App Attack
|
|
🇳🇱
Mangelot Hosting
|
|
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 8.235.96.35 (US/United States/35.96.235.8.bc.googleusercontent.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
|
Web App Attack
|
|
🇨🇦
SSH-Admin
|
|
Probing for Exploits on ns200
|
Exploited Host
Web App Attack
|
|
🇨🇦
SSH-Admin
|
|
Probing for Exploits on ns74
|
Exploited Host
Web App Attack
|
|
🇳🇱
WeCloudit-Anti-Abuse
|
|
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
|
Web App Attack
Hacking
|
|
Anonymous
|
|
Aggressive web scan
|
Web App Attack
|
|
🇺🇸
iwle
|
|
[Mon Nov 02 01:54:14.647845 2026] [:error] [pid 323614:tid 323658] [client 8.235.96.35:34394] [client 8.235.96.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\ ...
show more
[Mon Nov 02 01:54:14.647845 2026] [:error] [pid 323614:tid 323658] [client 8.235.96.35:34394] [client 8.235.96.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?:\\\\.env(?:\\\\.[^/]*)?|\\\\.git(?:/|$)|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak|old|save|tmp|swp|~))?|php-info\\\\.php|phpversion\\\\.php|info\\\\.php|debug\\\\.php|pinfo\\\\.php|pi\\\\.php|php\\\\.php|i\\\\.php|application_default_credentials\\\\.json|(?:firebase|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "mail.justuptowngames.com"] [uri "/css../.env"] [unique_id "augzlgbmUdopWDmoYbtlFQAAARA"]
[Mon Nov 02 01:54:14.648027 2026] [:error] [pid 323614:tid 323648] [client 8.235.96.35:34406] [client 8.235.96.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^|/)(?
...
show less
|
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
IP matched detection query 20 more in short time bad rqs.
|
Brute-Force
Web App Attack
Hacking
|
|
🇫🇷
dynamix
|
|
Multiple WAF Violations
|
Web App Attack
|
