๐ท๐ด
185.100.87.174
06 Sep 2026
185.100.87.174 - - [07/Sep/2026:00:17:49 +0200] "GET /wp-content/asshole.php HTTP/1.1" 404 1898 "-" ...
show more
185.100.87.174 - - [07/Sep/2026:00:17:49 +0200] "GET /wp-content/asshole.php HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
185.100.87.174 - - [07/Sep/2026:00:18:25 +0200] "GET /wp-content/uploads/2026/09/info.php HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
185.100.87.174 - - [07/Sep/2026:00:18:43 +0200] "GET //wp-content/themes/twentytwentyfour/db.php HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
...
show less
Hacking
Web App Attack
๐ซ๐ฎ
45.137.69.13
06 Sep 2026
45.137.69.13 - - [07/Sep/2026:00:01:58 +0200] "GET /wp-content/shell.php HTTP/1.1" 404 1898 "-" "Moz ...
show more
45.137.69.13 - - [07/Sep/2026:00:01:58 +0200] "GET /wp-content/shell.php HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
45.137.69.13 - - [07/Sep/2026:00:02:05 +0200] "GET /wp-content/c99.php HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
45.137.69.13 - - [07/Sep/2026:00:02:14 +0200] "GET /wp-content/asshole.php HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
...
show less
Hacking
Web App Attack
๐ท๐ธ
150.40.126.115
06 Sep 2026
150.40.126.115 - - [07/Sep/2026:00:00:24 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; ...
show more
150.40.126.115 - - [07/Sep/2026:00:00:24 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
150.40.126.115 - - [07/Sep/2026:00:00:33 +0200] "GET /.bak HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
150.40.126.115 - - [07/Sep/2026:00:00:44 +0200] "GET /wp-admin HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
...
show less
Hacking
Web App Attack
๐จ๐ญ
107.189.30.49
06 Sep 2026
107.189.30.49 - - [06/Sep/2026:23:57:22 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; ...
show more
107.189.30.49 - - [06/Sep/2026:23:57:22 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
107.189.30.49 - - [06/Sep/2026:23:57:32 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
107.189.30.49 - - [06/Sep/2026:23:57:36 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
...
show less
Hacking
Web App Attack
๐จ๐ญ
104.244.73.193
06 Sep 2026
104.244.73.193 - - [06/Sep/2026:23:50:18 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11 ...
show more
104.244.73.193 - - [06/Sep/2026:23:50:18 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
104.244.73.193 - - [06/Sep/2026:23:50:29 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
104.244.73.193 - - [06/Sep/2026:23:50:35 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
...
show less
Hacking
Web App Attack
๐จ๐ญ
107.189.8.56
06 Sep 2026
107.189.8.56 - - [06/Sep/2026:23:47:31 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php ...
show more
107.189.8.56 - - [06/Sep/2026:23:47:31 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
107.189.8.56 - - [06/Sep/2026:23:48:04 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
107.189.8.56 - - [06/Sep/2026:23:48:45 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0"
...
show less
Hacking
Web App Attack
๐จ๐ญ
104.244.73.190
06 Sep 2026
104.244.73.190 - - [06/Sep/2026:23:40:08 +0200] "GET /.env.bak HTTP/1.1" 404 1898 "-" "curl/8.14.1"
...
show more
104.244.73.190 - - [06/Sep/2026:23:40:08 +0200] "GET /.env.bak HTTP/1.1" 404 1898 "-" "curl/8.14.1"
104.244.73.190 - - [06/Sep/2026:23:40:16 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "curl/8.14.1"
104.244.73.190 - - [06/Sep/2026:23:41:25 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "curl/8.14.1"
...
show less
Hacking
Web App Attack
๐ณ๐ฑ
185.218.86.11
06 Sep 2026
185.218.86.11 - - [06/Sep/2026:19:32:32 +0200] "GET /.git/config HTTP/1.1" 404 1898 "-" "Mozilla/5.0 ...
show more
185.218.86.11 - - [06/Sep/2026:19:32:32 +0200] "GET /.git/config HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0"
185.218.86.11 - - [06/Sep/2026:19:32:34 +0200] "GET /index.php?s=/Index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1 HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"
185.218.86.11 - - [06/Sep/2026:19:32:35 +0200] "GET /index.php?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1 HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"
...
show less
Hacking
Web App Attack
๐ฎ๐ธ
82.221.128.191
06 Sep 2026
82.221.128.191 - - [06/Sep/2026:12:17:24 +0200] "GET /wp-content HTTP/1.1" 404 1898 "https://search. ...
show more
82.221.128.191 - - [06/Sep/2026:12:17:24 +0200] "GET /wp-content HTTP/1.1" 404 1898 "https://search.yahoo.com/" "Mozilla/5.0 (Linux; Android 4.4.2; SM-T320 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36"
82.221.128.191 - - [06/Sep/2026:12:17:26 +0200] "GET /wp-content-cache HTTP/1.1" 404 1898 "https://www.startpage.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36"
82.221.128.191 - - [06/Sep/2026:12:17:27 +0200] "GET /wp-contents HTTP/1.1" 404 1898 "https://www.bing.com/" "Mozilla/5.0 (PlayStation 4 2.57) AppleWebKit/537.73 (KHTML, like Gecko)"
...
show less
Hacking
Web App Attack
๐ฒ๐ฉ
178.175.148.155
06 Sep 2026
178.175.148.155 - - [06/Sep/2026:10:04:51 +0200] "GET /shell HTTP/1.1" 404 1898 "https://www.ekoru.o ...
show more
178.175.148.155 - - [06/Sep/2026:10:04:51 +0200] "GET /shell HTTP/1.1" 404 1898 "https://www.ekoru.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Firefox/40.0"
178.175.148.155 - - [06/Sep/2026:10:04:53 +0200] "GET /shelley HTTP/1.1" 404 1898 "https://swisscows.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.13 Safari/537.36"
178.175.148.155 - - [06/Sep/2026:10:04:54 +0200] "GET /shelly HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
...
show less
Hacking
Web App Attack
๐จ๐ญ
104.244.77.208
06 Sep 2026
104.244.77.208 - - [06/Sep/2026:08:28:26 +0200] "GET /phpmyadmin HTTP/1.1" 404 1898 "https://you.com ...
show more
104.244.77.208 - - [06/Sep/2026:08:28:26 +0200] "GET /phpmyadmin HTTP/1.1" 404 1898 "https://you.com/" "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; Touch; rv:11.0) like Gecko"
104.244.77.208 - - [06/Sep/2026:08:28:27 +0200] "GET /phpmyadmin2 HTTP/1.1" 404 1898 "https://www.presearch.com/" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
104.244.77.208 - - [06/Sep/2026:08:28:29 +0200] "GET /phpmyadmin3 HTTP/1.1" 404 1898 "https://www.seznam.cz/" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; WebView/1.0)"
...
show less
Hacking
Web App Attack
๐จ๐ญ
104.244.79.61
06 Sep 2026
104.244.79.61 - - [06/Sep/2026:03:43:49 +0200] "GET /dev HTTP/1.1" 301 162 "https://search.yahoo.com ...
show more
104.244.79.61 - - [06/Sep/2026:03:43:49 +0200] "GET /dev HTTP/1.1" 301 162 "https://search.yahoo.com/" "Mozilla/5.0 (Linux; Android 4.4.3; KFSAWI Build/KTU84M) AppleWebKit/537.36 (KHTML, like Gecko) Silk/44.1.81 like Chrome/44.0.2403.128 Safari/537.36"
...
show less
Hacking
Web App Attack
๐ฉ๐ช
34.159.5.185
06 Sep 2026
34.159.5.185 - - [06/Sep/2026:03:21:19 +0200] "GET /.env.bak HTTP/1.1" 404 1898 "-" "crusader-worker ...
show more
34.159.5.185 - - [06/Sep/2026:03:21:19 +0200] "GET /.env.bak HTTP/1.1" 404 1898 "-" "crusader-worker/1.0"
34.159.5.185 - - [06/Sep/2026:03:21:19 +0200] "GET /.env.old HTTP/1.1" 404 1898 "-" "crusader-worker/1.0"
34.159.5.185 - - [06/Sep/2026:03:21:19 +0200] "GET /.env.backup HTTP/1.1" 404 1898 "-" "crusader-worker/1.0"
...
show less
Hacking
Web App Attack
๐ณ๐ฑ
185.93.89.96
06 Sep 2026
185.93.89.96 - - [06/Sep/2026:02:46:57 +0200] "GET /cgi-bin HTTP/1.1" 404 1898 "https://search.naver ...
show more
185.93.89.96 - - [06/Sep/2026:02:46:57 +0200] "GET /cgi-bin HTTP/1.1" 404 1898 "https://search.naver.com/" "Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SM-N910V 4G Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36"
185.93.89.96 - - [06/Sep/2026:02:46:59 +0200] "GET /cgi-bin-church HTTP/1.1" 404 1898 "https://www.mojeek.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.91 Safari/537.36"
185.93.89.96 - - [06/Sep/2026:02:47:01 +0200] "GET /cgi-bin-debug HTTP/1.1" 404 1898 "https://www.ekoru.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36"
...
show less
Hacking
Web App Attack
๐ฉ๐ฐ
185.129.61.4
05 Sep 2026
185.129.61.4 - - [05/Sep/2026:22:46:30 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Windo ...
show more
185.129.61.4 - - [05/Sep/2026:22:46:30 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
185.129.61.4 - - [05/Sep/2026:22:46:32 +0200] "GET /.env/ HTTP/1.1" 404 1898 "https://myselfhosted.online/" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; EIE10;ENUSMSE; rv:11.0) like Gecko"
185.129.61.4 - - [05/Sep/2026:22:46:33 +0200] "GET /.env/ HTTP/1.1" 404 1898 "https://www.google.com/" "Mozilla/5.0 (Windows NT 6.0; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0"
...
show less
Hacking
Web App Attack
๐ฉ๐ช
185.220.101.97
05 Sep 2026
185.220.101.97 - - [05/Sep/2026:22:45:34 +0200] "GET /.env/ HTTP/1.1" 404 1898 "https://duckduckgo.c ...
show more
185.220.101.97 - - [05/Sep/2026:22:45:34 +0200] "GET /.env/ HTTP/1.1" 404 1898 "https://duckduckgo.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2505.0 Safari/537.36"
185.220.101.97 - - [05/Sep/2026:22:45:36 +0200] "GET /.env/ HTTP/1.1" 404 1898 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36"
185.220.101.97 - - [05/Sep/2026:22:45:38 +0200] "GET /.env/ HTTP/1.1" 404 1898 "https://www.bing.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.107 Safari/537.36"
...
show less
Hacking
Web App Attack
๐จ๐ฆ
20.151.10.161
04 Sep 2026
20.151.10.161 - - [04/Sep/2026:23:57:36 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ...
show more
20.151.10.161 - - [04/Sep/2026:23:57:36 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 1898 "-" "-"
20.151.10.161 - - [04/Sep/2026:23:57:41 +0200] "GET /wp-content/uploads/ HTTP/1.1" 404 1898 "-" "-"
20.151.10.161 - - [04/Sep/2026:23:57:43 +0200] "GET /das.php HTTP/1.1" 404 1898 "-" "-"
...
show less
Hacking
Web App Attack
๐ง๐ท
35.198.12.206
04 Sep 2026
35.198.12.206 - - [04/Sep/2026:14:00:46 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "crusader-worker/1. ...
show more
35.198.12.206 - - [04/Sep/2026:14:00:46 +0200] "GET /.env HTTP/1.1" 404 1898 "-" "crusader-worker/1.0"
35.198.12.206 - - [04/Sep/2026:14:00:46 +0200] "GET /.env.dev HTTP/1.1" 404 1898 "-" "crusader-worker/1.0"
35.198.12.206 - - [04/Sep/2026:14:00:46 +0200] "GET /.env.backup HTTP/1.1" 404 1898 "-" "crusader-worker/1.0"
...
show less
Hacking
Web App Attack
๐ต๐ฑ
79.188.216.214
03 Sep 2026
Manual review: fake Googlebot / suspicious crawler. Same IP first requested /robots.txt using Safari ...
show more
Manual review: fake Googlebot / suspicious crawler. Same IP first requested /robots.txt using Safari UA, then switched to Googlebot UA for repeated /sitemap.xml requests. Reverse DNS is hsi214.internetdsl.tpnet.pl (Orange Polska), not googlebot.com/google.com, so Googlebot identity verification failed. Observed in nginx logs on 2026-09-03.
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
45.45.237.97
03 Sep 2026
...
Hacking
Web App Attack
๐บ๐ธ
66.187.5.104
03 Sep 2026
...
Hacking
Web App Attack
๐ฉ๐ช
57.129.15.203
03 Sep 2026
...
Hacking
Web App Attack
๐ฉ๐ช
172.236.201.215
03 Sep 2026
...
Hacking
Web App Attack
๐ฏ๐ต
34.84.55.253
03 Sep 2026
...
Hacking
Web App Attack
๐บ๐ธ
2606:65c0:10:33f:77d:4666:b64c:cfee
03 Sep 2026
...
Hacking
Web App Attack