🇲🇽
octageeks.com
2026-10-03 04:13:37
(1 month ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇬🇧
noise.agency
2026-10-02 15:06:38
(1 month ago)
34.53.220.205 (BE/Belgium/205.220.53.34.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
🇩🇪
BlueWire Hosting
2026-10-02 14:46:36
(1 month ago)
Aggressive scanning resulting into 404
Bad Web Bot
🇩🇪
Marco711
2026-10-02 12:45:30
(1 month ago)
CrowdSec: crowdsecurity/http-path-traversal-probing
Web App Attack
🇺🇸
Charlesiv
2026-10-02 12:06:15
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (POST method)
Endpoint: /index.php
Query: ?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
Timestamp: 2026-10-02T10:45:58 ...
show more
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (POST method)
Endpoint: /index.php
Query: ?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
Timestamp: 2026-10-02T10:45:58Z
Ray ID: a4431ee0c8a6bb64
UA: Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 11:55:34
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.53.220.205 (205.220.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:55:30.515134 2026] [security2:error] [pid 5318:tid 5 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.53.220.205 (205.220.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:55:30.515134 2026] [security2:error] [pid 5318:tid 5318] [client 34.53.220.205:34040] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "birdlovers.net"] [uri "/.htpasswd"] [unique_id "ar-bsvXZ8vfq2k3RKmXVXwAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 11:39:58
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.53.220.205 (205.220.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:39:54.992782 2026] [security2:error] [pid 18792:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.53.220.205 (205.220.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:39:54.992782 2026] [security2:error] [pid 18792:tid 18792] [client 34.53.220.205:57912] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.thehallway.net"] [uri "/web.config"] [unique_id "ar-YClqBHE1iWJnA6n7KXQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-02 10:35:50
(1 month ago)
709 requests with url.path *.env
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 10:02:13
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.53.220.205 (205.220.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:02:05.671459 2026] [security2:error] [pid 21990:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.53.220.205 (205.220.53.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:02:05.671459 2026] [security2:error] [pid 21990:tid 21990] [client 34.53.220.205:46736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mydobdate.net"] [uri "/static../.env"] [unique_id "ar-BHb8I-9SsYRJdzbFOZgAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-02 08:47:31
(1 month ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-02 08:45:21
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇪🇸
robotstxt
2026-10-02 08:12:59
(1 month ago)
34.53.220.205 - - [02/Oct/2026:08:11:57 +0000] "GET /bbco5zq7hyeisu4g88di HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" "-" edge="34.53.220.205"
34.53.220.205 - - [02/Oct/2026:08:11:57 +0000] "GET /secure H ...
show more
34.53.220.205 - - [02/Oct/2026:08:11:57 +0000] "GET /bbco5zq7hyeisu4g88di HTTP/2.0" 403 189 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" "-" edge="34.53.220.205"
34.53.220.205 - - [02/Oct/2026:08:11:57 +0000] "GET /secure HTTP/2.0" 403 165 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "-" edge="34.53.220.205"
34.53.220.205 - - [02/Oct/2026:08:11:57 +0000] "GET /auth HTTP/2.0" 403 165 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "-" edge="34.53.220.205"
34.53.220.205 - - [02/Oct/2026:08:11:57 +0000] "GET /users/login HTTP/2.0" 403 165 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "-" edge="34.53.220.205"
34.53.220.205 - - [02/Oct/2026:08:11:57 +0000] "GET /sign-in HTTP/2.0" 403 165 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
...
show less
Web App Attack
🇩🇪
Hagen Schoebel
2026-10-02 08:00:14
(1 month ago)
Blocked by CrowdSec - Enabling body inspection (BE)
Port Scan
Brute-Force
Web App Attack
SSH
🇩🇪
updown.io
2026-10-02 07:26:51
(1 month ago)
{"level":"info","ts":1790926010.5897303,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.53.220.205","remote_port":"56494","client_ip":"34.53.220.205","proto":"HTTP/2.0","method":"POST","host":"status.solovyov.net"," ...
show more
{"level":"info","ts":1790926010.5897303,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.53.220.205","remote_port":"56494","client_ip":"34.53.220.205","proto":"HTTP/2.0","method":"POST","host":"status.solovyov.net","uri":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","headers":{"Content-Length":["90"],"Accept-Encoding":["gzip"],"Content-Type":["text/plain"],"User-Agent":["Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.solovyov.net","ech":false}},"bytes_read":0,"user_id":"","duration":0.000111954,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1790926010.5910764,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.53.220.205","remote_port":"56494","client_ip":"34.53.220.205","proto":"H
...
show less
DDoS Attack
Web App Attack
🇺🇸
interbiznw.com
2026-10-02 07:09:23
(1 month ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
