🇬🇧
sc user
2026-10-12 05:52:19
(3 weeks ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
sc user
2026-10-10 11:38:36
(3 weeks ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
sc user
2026-10-08 23:56:14
(3 weeks ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
sc user
2026-10-07 00:48:08
(3 weeks ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
openstrike.co.uk
2026-10-06 05:13:51
(4 weeks ago)
60 attacks on shell probes, env grabbing URLs, env grabbing URLs (type 2), config grabbing URLs (type 2), password/key grabbing URLs, PHP URLs:
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /_image?href=/../../.. ...
show more
60 attacks on shell probes, env grabbing URLs, env grabbing URLs (type 2), config grabbing URLs (type 2), password/key grabbing URLs, PHP URLs:
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /_image?href=/../../../.env HTTP/1.1
GET /public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ HTTP/1.1
GET /app-config.json HTTP/1.1
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=rsc HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
zcampbell
2026-10-05 17:52:16
(4 weeks ago)
Web vulnerability scanning: probing for exposed sensitive files (.ssh). Detected and blocked automatically.
Web App Attack
Bad Web Bot
🇬🇧
pinguin
2026-10-05 15:54:21
(4 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from JP.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /cgi-bin/php-cgi
UA: Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)
This report was generated by:
https://github.com/sefin ...
show more
Triggered Cloudflare WAF (firewallManaged) from JP.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /cgi-bin/php-cgi
UA: Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇬🇧
thetomtaylor.co.uk
2026-10-05 13:07:01
(4 weeks ago)
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [mx02,wa02]
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 11:01:24
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.85.46.220 (220.46.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:01:19.223875 2026] [security2:error] [pid 14191:tid 14 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.46.220 (220.46.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:01:19.223875 2026] [security2:error] [pid 14191:tid 14191] [client 34.85.46.220:59624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.flybits.co.uk"] [uri "/.htpasswd"] [unique_id "asODf3RpkbesC2KyHz4lagAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 10:42:47
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.85.46.220 (220.46.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 06:42:42.002760 2026] [security2:error] [pid 19265:tid 19 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.46.220 (220.46.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 06:42:42.002760 2026] [security2:error] [pid 19265:tid 19265] [client 34.85.46.220:34570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.zenventures.co.uk"] [uri "/img../.env"] [unique_id "asN_IlcmF4DwKEST-1RSdwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
CrownSync.uk
2026-10-05 10:26:51
(4 weeks ago)
Automated detection: repeated HTTP 4xx scan-burst against a public web endpoint.
Port Scan
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-05 10:07:19
(4 weeks ago)
(mod_security) mod_security (id:949110) triggered by 34.85.46.220 (JP/Japan/220.46.85.34.bc.googleusercontent.com): N in the last X secs
Web App Attack
🇳🇱
pearbright
2026-10-05 10:06:21
(4 weeks ago)
[Mon Oct 05 10:06:17.317368 2026] [core:error] [pid 2048054:tid 2048054] [client 34.85.46.220:48498] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 05 10:06:21.706139 2026] [core:error] [pid 204826 ...
show more
[Mon Oct 05 10:06:17.317368 2026] [core:error] [pid 2048054:tid 2048054] [client 34.85.46.220:48498] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 05 10:06:21.706139 2026] [core:error] [pid 2048265:tid 2048265] [client 34.85.46.220:58460] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
...
show less
Web App Attack
🇸🇬
simpeg-adm.bandung.go.id
2026-10-05 09:07:47
(4 weeks ago)
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/f37fvc6qzxx3bqehuz23"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/dist/.vite/manifest.json"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/z9x8c7v6b5-debug-trigger-app.alexbucklandphotography.co.uk"
05/Oct/2026:09:0 ...
show more
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/f37fvc6qzxx3bqehuz23"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/dist/.vite/manifest.json"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/z9x8c7v6b5-debug-trigger-app.alexbucklandphotography.co.uk"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/u58fb56vqf6fqd5tdm0r"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/dist/manifest.json"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/lib/terminal-xhr.php"
05/Oct/2026:09:07:46 +0000;34.85.46.220;"/.vite/manifest.json"
...
show less
Web Spam
Brute-Force
Web App Attack
🇯🇵
ki3
2026-10-05 08:35:30
(4 weeks ago)
Fail2Ban: Web App Attacks and Forum Spam 34.85.46.220 1791189329.0(JST)
Web Spam
Bad Web Bot
Web App Attack
