🇬🇧
195.140.214.20
23 Oct 2026
Unknown connection on port 3205. Payload entropy 1.66; file type data. Payload: \x04\x01\x00P\x00\x0 ...
show more
Unknown connection on port 3205. Payload entropy 1.66; file type data. Payload: \x04\x01\x00P\x00\x00\x00\x01\x00
show less
Port Scan
Hacking
🇬🇧
154.16.44.162
23 Oct 2026
Port Scan connection on port 3205. File type empty.
Port Scan
Hacking
🇸🇬
139.59.246.235
23 Oct 2026
[pit,ycr] HTTP-Probe on port 443 (via domain). 9 distinct paths probed in 1min. Sustained 11 req/min ...
show more
[pit,ycr] HTTP-Probe on port 443 (via domain). 9 distinct paths probed in 1min. Sustained 11 req/min, 9 nonexistent paths (404). Paths: //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php, //images/images/cache.php, //images/images/images/cache.php, //images/images/images/images/cache.php, //images/images/images/images/images/cache.php, //images/images/images/images/images/images/cache.php, //images/images/images/images/images/images/images/cache.php, //images/images/images/images/images/images/images/images/cache.php, //wp-content/plugins/plugins/cache.php
show less
Bad Web Bot
Web App Attack
🇧🇷
34.95.146.222
23 Oct 2026
[swy] HTTP-Probe on port 443 (via domain). 163 distinct paths probed in 35s. Sustained 173 req/min, ...
show more
[swy] HTTP-Probe on port 443 (via domain). 163 distinct paths probed in 35s. Sustained 173 req/min, 136 nonexistent paths (404). Paths: /.ssh/id_ed25519, /.env.dev.local, /.env.keys, /.env.preprod, /.ssh/id_rsa, /.env.staging.local, /.env.supabase, /.env.credentials, /.ssh/config, /.env.production.local, /.env.secret, /.env.prod.local, /.env.development.local, /.env.config, /.env.testing, /apps/.env, /client/.env, /packages/.env, /services/.env, /_image?href=/../../../.env, /%2Fadmin, /%2Fapi/config, /%2Fdashboard, /%2Fsettings, /.azure/accessTokens.json, /.bashrc, /.cache/huggingface/token, /.cargo/credentials.toml, /.config/gcloud/application_default_credentials.json, /.config/gcloud/credentials.db, /.dbeaver/credentials-config.json, /.envrc, /.my.cnf, /.pgpass, /.vault-token, /.zshrc, /_next, /_next/server, /account, /account/login, /actions, /admin, /admin/login, /admin/settings, /admin/users, /agents, /alerts, /api, /api-docs, /api-keys, /api/auth, /api/graphql, …
show less
Bad Web Bot
Web App Attack
🇺🇸
34.23.185.185
23 Oct 2026
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 1s. Sustained 2 req/min. Paths ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 1s. Sustained 2 req/min. Paths: /.git/config
show less
Bad Web Bot
Web App Attack
🇨🇦
85.217.149.0
23 Oct 2026
Unknown connection on port 4854. File type ASCII text, with no line terminators. Payload: 00000000
Port Scan
Hacking
🇸🇬
129.212.233.218
23 Oct 2026
[pit,ycr] HTTP-Probe on port 443 (via domain). 11 distinct paths probed in 2min. Sustained 10 req/mi ...
show more
[pit,ycr] HTTP-Probe on port 443 (via domain). 11 distinct paths probed in 2min. Sustained 10 req/min, 11 nonexistent paths (404). Paths: //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php, //assets/images/images/cache.php, //blogs/media/media/cache.php, //images/images/cache.php, //images/images/images/cache.php, //images/images/images/images/cache.php, //images/images/images/images/images/cache.php, //images/images/images/images/images/images/cache.php, //images/images/images/images/images/images/images/cache.php, //images/images/images/images/images/images/images/images/cache.php, //wp-content/plugins/plugins/cache.php
show less
Bad Web Bot
Web App Attack
🇺🇸
34.74.37.180
23 Oct 2026
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 1s. Sustained 2 req/min. Paths ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 1s. Sustained 2 req/min. Paths: /.git/config
show less
Bad Web Bot
Web App Attack
🇰🇷
125.131.2.30
23 Oct 2026
[pit,ycr] HTTP-Probe on port 443 (via domain). 5 distinct paths probed in 25min. Sustained 0 req/min ...
show more
[pit,ycr] HTTP-Probe on port 443 (via domain). 5 distinct paths probed in 25min. Sustained 0 req/min, 4 nonexistent paths (404). Paths: /WORDPRESS, /WordPress, /Wordpress, /wordpress
show less
Bad Web Bot
Web App Attack
🇺🇸
34.139.102.100
23 Oct 2026
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 1s. Sustained 2 req/min. Paths ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 1s. Sustained 2 req/min. Paths: /.git/config
show less
Bad Web Bot
Web App Attack
🇧🇷
34.39.160.18
23 Oct 2026
[ycr] HTTP-Probe on port 443 (via domain). 137 distinct paths probed in 40s. Sustained 147 req/min, ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 137 distinct paths probed in 40s. Sustained 147 req/min, 134 nonexistent paths (404). Paths: /.env.production.local, /.env.staging.local, /.env.supabase, /.ssh/config, /.ssh/id_rsa, /.env.prod.local, /.env.config, /.env.testing, /.ssh/id_ed25519, /.env.development.local, /.env.preprod, /@fs/app/.env?raw??, /@fs/home/ec2-user/.aws/credentials?raw??, /@fs/.env?url&raw??, /@fs/../.env?raw??, /@fs/root/.aws/credentials?raw??, /@fs/home/ubuntu/.aws/credentials?raw??, /@fs/src/.env?raw??, /@fs/var/task/.env?raw??, /@fs/proc/self/cwd/.env?raw??, /@fs/.env?raw&url??, /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??, /@fs/.env?import&?raw??, /.azure/accessTokens.json, /.bashrc, /.cache/huggingface/token, /.cargo/credentials.toml, /.config/gcloud/application_default_credentials.json, /.config/gcloud/credentials.db, /.dbeaver/credentials-config.json, /.envrc, /.my.cnf, /.pgpass, /.vault-token, /.zshrc, /0rodpta640gfgmpu8723, …
show less
Bad Web Bot
Web App Attack
🇻🇳
160.187.147.141
23 Oct 2026
[swy] HTTP-Probe on port 443 (via domain). 3 distinct paths probed in 4s. Sustained 5 req/min. Paths ...
show more
[swy] HTTP-Probe on port 443 (via domain). 3 distinct paths probed in 4s. Sustained 5 req/min. Paths: /.git/config, /
show less
Bad Web Bot
Web App Attack
🇩🇪
35.246.255.183
23 Oct 2026
[swy] HTTP-Probe on port 443 (via domain). 195 distinct paths probed in 42s. Sustained 206 req/min, ...
show more
[swy] HTTP-Probe on port 443 (via domain). 195 distinct paths probed in 42s. Sustained 206 req/min, 168 nonexistent paths (404). Paths: /.env.keys, /.env.dev.local, /.env.secret, /.env.credentials, /.env.production.local, /.env.supabase, /.env.staging.local, /.ssh/id_rsa, /.env.preprod, /.ssh/id_ed25519, /.ssh/config, /.env.development.local, /.env.testing, /.env.prod.local, /.env.config, /_image?href=/../../../.env, /workspace/.env, /packages/.env, /client/.env, /apps/.env, /services/.env, /api/v1/.env, /deploy/.env, /agents/.env, /scripts/.env, /project/.env, /infra/.env, /agent/.env, /chatbot/.env, /pipeline/.env, /pkg/.env, /llm/.env, /common/.env, /data/.env, /bot/.env, /utils/.env, /ai/.env, /lib/.env, /internal/.env, /model/.env, /ml/.env, /shared/.env, /cmd/.env, /cms/.env, /portal/.env, /%2Fadmin, /%2Fapi/config, /%2Fdashboard, /%2Fsettings, /.amplifyrc, /.azure/accessTokens.json, /.bashrc, /.cache/huggingface/token, /.cargo/credentials.toml, …
show less
Bad Web Bot
Web App Attack
🇸🇪
104.23.221.97
23 Oct 2026
[pit] HTTP-Probe on port 443 (via domain). 5 distinct paths probed in 1s. Sustained 5 req/min, 5 non ...
show more
[pit] HTTP-Probe on port 443 (via domain). 5 distinct paths probed in 1s. Sustained 5 req/min, 5 nonexistent paths (404). Paths: /, /administrator/, /api.php, /info.php, /phpinfo.php
show less
Bad Web Bot
Web App Attack
🇧🇷
35.198.57.29
23 Oct 2026
[ycr] HTTP-Probe on port 443 (via domain). 195 distinct paths probed in 30s. Sustained 206 req/min, ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 195 distinct paths probed in 30s. Sustained 206 req/min, 192 nonexistent paths (404). Paths: /.env.supabase, /.htpasswd, /.env.staging.local, /.env.keys, /.env.secret, /.env.preprod, /.env.credentials, /.ssh/id_ed25519, /.env.production.local, /.ssh/config, /.env.dev.local, /.ssh/id_rsa, /.env.prod.local, /.env.development.local, /@fs/home/ubuntu/.aws/credentials?raw??, /.env.testing, /.env.config, /@fs/root/.aws/credentials?raw??, /@fs/src/.env?raw??, /@fs/app/.env?raw??, /@fs/../.env?raw??, /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??, /@fs/var/task/.env?raw??, /@fs/home/ec2-user/.aws/credentials?raw??, /@fs/proc/self/cwd/.env?raw??, /@fs/src/.env?import&raw??, /@fs/.env?raw&url??, /@fs/app/.env.production?import&raw??, /@fs/.env?import&?raw??, /@fs/.env?url&raw??, /@fs/app/.env.local?import&raw??, /@fs/app/.env?import&raw??, /@fs/../.env?import&raw??, /.env.development?import&raw, /.env.development?raw, …
show less
Bad Web Bot
Web App Attack
🇧🇪
130.211.85.163
23 Oct 2026
[swy] HTTP-Probe on port 443 (via domain). 114 distinct paths probed in 2s. Sustained 114 req/min, 1 ...
show more
[swy] HTTP-Probe on port 443 (via domain). 114 distinct paths probed in 2s. Sustained 114 req/min, 104 nonexistent paths (404). Paths: /core/.env, /.git/config, /app/.env, /sendgrid.env, /api/.env, /.env, /.git/logs/HEAD, /.env.example, /backend/.env, /.aws/credentials, /admin/.env, /demo/.env, /laravel/.env, /server/.env, /application/.env, /.env.save, /.env.local, /.env.production, /.git/logs/refs/heads/main, /vendor/composer/installed.json, /.env.backup, /.git-credentials, /.env.bak, /.aws/.env, /config/.env, /public/.env, /.env.swp, /test/.env, /media/.env, /.env.sample, /dev/.env, /backup/.env, /staging/.env, /.env.dist, /v1/.env, /web/.env, /.env.aws, /.docker/.env, /.env.development, /.env.prod, /.env.anthropic, /.docker/laravel/app/.env, /.env.dev, /.aws/config, /old/.env, /v2/.env, /cms/.env, /src/.env, /.aws/credentials.bak, /config.env, /.env.testing, /production/.env, /back/.env, /new/.env, /.env.docker, /wp-config.php.bak, /.env.old, /.env.php, /.env.live, …
show less
Bad Web Bot
Web App Attack
🇧🇪
35.205.131.43
23 Oct 2026
[ttn] HTTP-Probe on port 443 (via domain). 114 distinct paths probed in 2s. Sustained 114 req/min, 7 ...
show more
[ttn] HTTP-Probe on port 443 (via domain). 114 distinct paths probed in 2s. Sustained 114 req/min, 73 known bad path signatures. Paths: /phpinfo.php, /api/.env, /core/.env, /phpinfo, /backend/.env, /.aws/credentials, /sendgrid.env, /app/.env, /.git/logs/HEAD, /.env, /.env.example, /.git/config, /admin/.env, /demo/.env, /info.php, /laravel/.env, /_profiler/phpinfo, /.env.local, /server/.env, /.env.save, /composer.json, /application/.env, /.env.production, /.git/logs/refs/heads/main, /.env.bak, /.env.backup, /.aws/.env, /config/.env, /public/.env, /.env.swp, /.env.sample, /test/.env, /backup/.env, /dev/.env, /.env.dist, /staging/.env, /media/.env, /wp-content/debug.log, /v1/.env, /config.php, /web/.env, /.env.aws, /.env.development, /.docker/.env, /.env.prod, /.env.anthropic, /.env-example, /.docker/laravel/app/.env, /.env.dev, /api/phpinfo.php, /.aws/config, /v2/.env, /old/.env, /src/.env, /cms/.env, /config.env, /.aws/credentials.bak, /production/.env, /.env.testing, …
show less
Bad Web Bot
Web App Attack
🇹🇼
34.81.18.95
22 Oct 2026
[swy] HTTP-Probe on port 443 (via domain). 74 distinct paths probed in 35s. Sustained 79 req/min, 73 ...
show more
[swy] HTTP-Probe on port 443 (via domain). 74 distinct paths probed in 35s. Sustained 79 req/min, 73 nonexistent paths (404). Paths: /.git/config, /.env, /.env.local, /.env.production, /.env.staging, /.env.development, /.env.test, /.env.remote, /.env.bak, /server-info.php, /server-status.php, /.config/gcloud/application_default_credentials.json, /_environment, /_phpinfo.php, /_profiler/phpinfo, /admin/phpinfo.php, /administrator/phpinfo.php, /application_default_credentials.json, /beta/phpinfo.php, /core/phpinfo.php, /cpanel/phpinfo.php, /credentials.json, /debug.php, /dev/phpinfo.php, /docs/phpinfo.php, /firebase-adminsdk.json, /firebase-key.json, /gcp-credentials.json, /gcp-key.json, /gcp-sa.json, /google-credentials.json, /google-key.json, /hosting/phpinfo.php, /htdocs/phpinfo.php, /i.php, /includes/phpinfo.php, /info, /info.php, /info.php.bak, /key.json, /keyfile.json, /mail/phpinfo.php, /old/phpinfo.php, /old_phpinfo.php, /p.php, /php-info.php, /php.php, /phpinfo, …
show less
Bad Web Bot
Web App Attack
🇸🇪
104.23.221.123
22 Oct 2026
[ycr] HTTP-Probe on port 443 (via domain). 6 distinct paths probed in 1s. Sustained 6 req/min, 6 non ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 6 distinct paths probed in 1s. Sustained 6 req/min, 6 nonexistent paths (404). Paths: /admin.php, /api.php, /index.php, /info.php, /phpinfo.php, /xmlrpc.php
show less
Bad Web Bot
Web App Attack
🇩🇪
130.12.180.165
22 Oct 2026
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 32min. Sustained 0 req/min. Pa ...
show more
[ycr] HTTP-Probe on port 443 (via domain). 1 distinct paths probed in 32min. Sustained 0 req/min. Paths: /.env
show less
Bad Web Bot
Web App Attack
🇬🇧
81.19.219.216
22 Oct 2026
HTTP connection on port 3205. Payload entropy 5.22; file type ASCII text, with CRLF line terminators ...
show more
HTTP connection on port 3205. Payload entropy 5.22; file type ASCII text, with CRLF line terminators. Payload: GET / HTTP/1.1\r\nHost: 76.155.84.161:3205\r\nUser-Agent: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\r\nAccept: */*\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n
show less
Port Scan
Hacking
Web App Attack
🇬🇧
193.32.209.232
22 Oct 2026
Unknown connection on port 3205. Payload entropy 3.15; file type ASCII text, with CRLF line terminat ...
show more
Unknown connection on port 3205. Payload entropy 3.15; file type ASCII text, with CRLF line terminators. Payload: AUTH TLS\r\nAUTH SSL\r\n
show less
Port Scan
Hacking
🇬🇧
81.19.219.195
22 Oct 2026
SOCKS Proxy connection on port 3205. Payload entropy 1.50; file type data. Payload: \x05\x02\x00\x02
Open Proxy
Port Scan
Hacking
🇬🇧
89.37.172.132
22 Oct 2026
Unknown connection on port 3205. Payload entropy 1.66; file type data. Payload: \x04\x01\x00P\x00\x0 ...
show more
Unknown connection on port 3205. Payload entropy 1.66; file type data. Payload: \x04\x01\x00P\x00\x00\x00\x01\x00
show less
Port Scan
Hacking
🇳🇱
86.38.187.140
22 Oct 2026
Port Scan connection on port 3205. File type empty.
Port Scan
Hacking