🇩🇪
palzer.IT
2026-10-28 12:41:21
(19 hours ago)
Report for plesk-apache-badbot: 34.159.55.185 - - [18/Oct/2026:13:14:36 +0200] GET /lib/terminal-xhr.php [DOMAIN_REMOVED] 404 111914 [DOMAIN_REMOVED] Mozilla/5.0 (compatible; Amazonbot/0.1; +[DOMAIN_REMOVED]
Bad Web Bot
🇧🇷
Caue Henrique
2026-10-23 03:00:01
(6 days ago)
Multiple common web attacks, XSS, Web Server 500 Error
Web Spam
Hacking
Web App Attack
🇩🇪
IVski.com
2026-10-23 02:15:46
(6 days ago)
IVski WAF | Suspicious activity detected - generic bot or scanner pattern
Hacking
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-22 22:02:04
(6 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-21.
Web App Attack
SSH
Hacking
🇳🇱
Alt255
2026-10-22 15:54:57
(6 days ago)
[ti-03ov] Excessive 404 errors (web scanning): 30 suspicious requests detected by fail2ban jail apache-404. Example: 34.159.55.185 - - [22/Oct/2026:17:54:40 +0200] "GET /core/.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; Bytespider; spider-fe ...
show more
[ti-03ov] Excessive 404 errors (web scanning): 30 suspicious requests detected by fail2ban jail apache-404. Example: 34.159.55.185 - - [22/Oct/2026:17:54:40 +0200] "GET /core/.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
34.159.55.185 - - [22/Oct/2026:17:54:40 +0200] "GET /.aws/config HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.159.55.185 - - [22/Oct/2026:17:54:40 +0200] "GET /.git/HEAD HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.159.55.185 - - [22/Oct/2026:17:54:40 +0200] "GET /web/.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
34.159.55.185 - - [22/Oct/2026:17:54:40 +0200] "GET /build/.env HTT
...
show less
Bad Web Bot
Web App Attack
🇫🇷
Zundapper
2026-10-22 15:30:15
(6 days ago)
34.159.55.185 - - [22/Oct/2026:17:30:13 +0200] "GET /robots.txt HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
34.159.55.185 - - [22/Oct/2026:17:30:13 +0200] "GET /sitemap.xml HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compati ...
show more
34.159.55.185 - - [22/Oct/2026:17:30:13 +0200] "GET /robots.txt HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
34.159.55.185 - - [22/Oct/2026:17:30:13 +0200] "GET /sitemap.xml HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
34.159.55.185 - - [22/Oct/2026:17:30:14 +0200] "GET /sitemap_index.xml HTTP/2.0" 404 106 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.159.55.185 - - [22/Oct/2026:17:30:15 +0200] "GET /user/login HTTP/2.0" 404 167 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
34.159.55.185 - - [22/Oct/2026:17:30:15 +0200] "GET /signup HTTP/2.0" 404 167 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
...
show less
Web App Attack
Port Scan
🇫🇷
IRISIO
2026-10-22 15:01:06
(6 days ago)
scans/SQL injection/spam posts : 36655 queries
Web App Attack
SQL Injection
🇺🇸
TPI-Abuse
2026-10-22 14:47:22
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 34.159.55.185 (185.55.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 10:47:16.605899 2026] [security2:error] [pid 1886:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.55.185 (185.55.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 10:47:16.605899 2026] [security2:error] [pid 1886:tid 1886] [client 34.159.55.185:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hvacs-aircon.com"] [uri "/.env.dev.local"] [unique_id "atoh9JSQakSPN021jc94EwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
svr
2026-10-22 14:40:35
(6 days ago)
Abusive Automated Web Scanner
Web App Attack
2026-10-22 14:01:55
(6 days ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇺🇸
Mundo Bueno
2026-10-22 14:00:09
(6 days ago)
[ISILIA Protection v2.3] Tentative d'accès: /.env.supabase [RATE LIMITED - 1800s quarantine] | Pays: DE | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexit
Hacking
Web App Attack
🇨🇭
4server
2026-10-22 13:57:20
(6 days ago)
[ThuOct2215:57:14.5086612026][security2:error][pid442199:tid442258][client34.159.55.185:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat ...
show more
[ThuOct2215:57:14.5086612026][security2:error][pid442199:tid442258][client34.159.55.185:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".com\"][severity\"ERROR\"][hostname\"hostingsvizzera.com\"][uri\"/z9x8c7v6b5-debug-trigger-hostingsvizzera.com\"][unique_id\"atoWOkzmT-ZSQtPXGZmalgAAAEM\"]
show less
Hacking
Web App Attack
🇫🇮
as211431.net
2026-10-22 08:34:34
(6 days ago)
Triggered Cloudflare WAF (firewallManaged) from DE.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /app
UA: Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)
This report was generated by:
https://github.com/sefinek/Cloudflar ...
show more
Triggered Cloudflare WAF (firewallManaged) from DE.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /app
UA: Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-10-22 06:17:02
(1 week ago)
Attempted access to sensitive endpoint (/.env.keys) detected. Automated scan or unauthorized probing.
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-22 06:08:57
(1 week ago)
2026/10/22 07:08:55 [error] 2314#2314: *115730 access forbidden by rule, client: 34.159.55.185, server: [redacted], request: "GET /_nuxt/../.env HTTP/2.0", host: "web.betatechnologies.info"
2026/10/22 07:08:55 [error] 2314#2314: *115730 access forbid ...
show more
2026/10/22 07:08:55 [error] 2314#2314: *115730 access forbidden by rule, client: 34.159.55.185, server: [redacted], request: "GET /_nuxt/../.env HTTP/2.0", host: "web.betatechnologies.info"
2026/10/22 07:08:55 [error] 2314#2314: *115730 access forbidden by rule, client: 34.159.55.185, server: [redacted], request: "GET /api/orders/..%2f..%2f.env HTTP/2.0", host: "web.betatechnologies.info"
2026/10/22 07:08:56 [error] 2314#2314: *115730 access forbidden by rule, client: 34.159.55.185, server: [redacted], request: "GET /packages/.env HTTP/2.0", host: "web.betatechnologies.info"
show less
Brute-Force
Web App Attack
