๐ณ๐ฑ
Alt255
2026-09-14 10:36:09
(1 month ago)
[ti-14al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail <nam ...
show more
[ti-14al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail <name>. Example: 34.83.235.38 - - \[06/Sep/2026:11:28:09 +0200\] "GET /api/v1/settings HTTP/1.1" 404 591 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0"
34.83.235.38 - - \[06/Sep/2026:11:28:10 +0200\] "GET /api/config HTTP/1.1" 404 591 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0"
34.83.235.38 - - \[06/Sep/2026:11:28:10 +0200\] "GET /wp-json HTTP/1.1" 404 5891 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0"
34.83.235.38 - - \[06/Sep/2026:11:28:10 +0200\] "GET /api/settings
...
show less
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Alt255
2026-09-11 15:39:34
(1 month ago)
34.83.235.38 - - \[06/Sep/2026:11:28:09 +0200\] "GET /api/v1/settings HTTP/1.1" 404 591 "-" "Mozilla ...
show more
34.83.235.38 - - \[06/Sep/2026:11:28:09 +0200\] "GET /api/v1/settings HTTP/1.1" 404 591 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0"
34.83.235.38 - - \[06/Sep/2026:11:28:10 +0200\] "GET /api/config HTTP/1.1" 404 591 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0"
34.83.235.38 - - \[06/Sep/2026:11:28:10 +0200\] "GET /wp-json HTTP/1.1" 404 5891 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0"
34.83.235.38 - - \[06/Sep/2026:11:28:10 +0200\] "GET /api/settings HTTP/1.1" 404 5891 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0"
34.83.235.38 - - \[06/Sep
...
show less
Bad Web Bot
Web App Attack
๐ฌ๐ง
openstrike.co.uk
2026-09-07 05:13:19
(1 month ago)
285 attacks on config grabbing URLs (type 2), password grabbing URLs, env grabbing URLs (type 2), en ...
show more
285 attacks on config grabbing URLs (type 2), password grabbing URLs, env grabbing URLs (type 2), env grabbing URLs, directory traversals, PHP URLs:
GET /secrets.json HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.aws/credentials&environmentName=rsc HTTP/1.1
GET /_image?href=/proc/self/environ HTTP/1.1
GET /backend/.env HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
GET /app_dev.php/_profiler HTTP/1.1
show less
Hacking
Web App Attack
๐ณ๐ฑ
Savvii
2026-09-07 02:49:19
(1 month ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
๐ฌ๐ง
blik2108
2026-09-07 02:32:06
(1 month ago)
34.83.235.38 - - [07/Sep/2026:02:32:04 +0000] "GET /rclone.conf HTTP/1.1" 404 3431 "-" "Mozilla/5.0 ...
show more
34.83.235.38 - - [07/Sep/2026:02:32:04 +0000] "GET /rclone.conf HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" "-"
34.83.235.38 - - [07/Sep/2026:02:32:04 +0000] "GET /z9x8c7v6b5-debug-trigger-solentyachtcharter.com HTTP/1.1" 404 3431 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36" "-"
34.83.235.38 - - [07/Sep/2026:02:32:05 +0000] "GET /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ HTTP/1.1" 404 54 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" "-"
34.83.235.38 - - [07/Sep/2026:02:32:05 +0000] "GET /api/fs/read?path=/proc/self/environ&allowOutsideWorkspace=true HTTP/1.1" 404 54 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" "-"
34.83.235.38 - - [07/Sep/2026:02:32:05 +0000] "GET /api/fs/read?path=/app/.env&allowOutsideWorkspace=true HTTP/1.1" 404 54 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)" "-"
34
...
show less
Web App Attack
๐ฉ๐ช
netclix.gr
2026-09-07 02:09:45
(1 month ago)
(mod_security) mod_security triggered on hostname [redacted] 34.83.235.38 (US/United States/38.235.8 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.83.235.38 (US/United States/38.235.83.34.bc.googleusercontent.com): (CF_ENABLE)
show less
SQL Injection
๐ซ๐ท
mrcrassi
2026-09-07 01:25:09
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /private-key
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
๐ฌ๐ง
Marten Mark
2026-09-07 00:23:25
(1 month ago)
34.83.235.38 - - [07/Sep/2026:00:23:23 +0000] "GET /.aws/credentials HTTP/2.0" 404 23033 "-" "Mozill ...
show more
34.83.235.38 - - [07/Sep/2026:00:23:23 +0000] "GET /.aws/credentials HTTP/2.0" 404 23033 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Web App Attack
Bad Web Bot
๐ฉ๐ช
maxpower
2026-09-07 00:18:54
(1 month ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.83.235.38 (US/United States/38.235.83 ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.83.235.38 (US/United States/38.235.83.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.83.235.38 - - [07/Sep/2026:02:18:48 +0200] "GET /@fs/root/.aws/credentials?raw?? HTTP/2.0" 200 4738 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)" "34.83.235.38" host=villapardi.it
show less
Port Scan
๐ฉ๐ช
maxpower
2026-09-06 21:06:36
(1 month ago)
(junkbot) REGOLA 8 - Junk Bot Blocked 34.83.235.38 (US/United States/38.235.83.34.bc.googleuserconte ...
show more
(junkbot) REGOLA 8 - Junk Bot Blocked 34.83.235.38 (US/United States/38.235.83.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.83.235.38 - - [06/Sep/2026:23:06:31 +0200] "GET /application.yml HTTP/2.0" 200 4722 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )" "34.83.235.38" host=staging.villapardi.it
show less
Port Scan
Anonymous
2026-09-06 20:26:30
(1 month ago)
Portscan: TCP/8443 (5x), TCP/443, TCP/80, TCP/8080 (5x)
Port Scan
๐ณ๐ฑ
Savvii
2026-09-06 19:45:30
(1 month ago)
20 attempts against mh-misbehave-ban on mensa
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Savvii
2026-09-06 19:09:42
(1 month ago)
20 attempts against mh-misbehave-ban on solar
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-06 19:02:02
(1 month ago)
Bot / scanning and/or hacking attempts: GET /core/.env HTTP/2.0, GET /.env.php.bak HTTP/2.0, GET /co ...
show more
Bot / scanning and/or hacking attempts: GET /core/.env HTTP/2.0, GET /.env.php.bak HTTP/2.0, GET /config.php.bak HTTP/2.0, GET /public../.env HTTP/2.0, GET /public/plugins/grafana-clock-panel/../../../../../../../.., GET /api/fs/read?path=/app/.env&allowOutsideWorkspace=true HTTP, GET /_astro/pages/index.astro.mjs.map HTTP/2.0, GET /server-status HTTP/2.0
show less
Hacking
Web App Attack
๐ฉ๐ช
rh24
2026-09-06 18:11:24
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.83.235.38 (US/Uni ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.83.235.38 (US/United States/38.235.83.34.bc.googleusercontent.com)
show less
Bad Web Bot