2026-06-03 18:02:15
(2 weeks ago)
Web attack
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-05-29 09:35:03
(3 weeks ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇫🇷
Nicos
2026-05-28 19:46:22
(3 weeks ago)
2026-05-28T21:46:21.147675+02:00 PhoenixNas 7da3f54baead[1145222]: {"auth_via": "unauthenticated", " ...
show more
2026-05-28T21:46:21.147675+02:00 PhoenixNas 7da3f54baead[1145222]: {"auth_via": "unauthenticated", "domain_url": "auth.wise0wl.org", "event": "/auth/authorize", "host": "auth.wise0wl.org", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 382214, "remote": "103.4.251.61", "request_id": "c8c0c6a6b5e247df95f28328a68c4bca", "runtime": 10, "schema_name": "public", "scheme": "https", "status": 404, "timestamp": "2026-05-28T19:46:21.147540", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}
2026-05-28T21:46:22.019744+02:00 PhoenixNas 7da3f54baead[1145222]: {"auth_via": "unauthenticated", "domain_url": "auth.wise0wl.org", "event": "/admin/version/history/", "host": "auth.wise0wl.org", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 398258, "remote": "103.4.251.61", "request_id": "6335412a790043158ea782ab4cd48932", "runtime": 19, "schema_name": "public", "scheme":
...
show less
Hacking
Brute-Force
🇯🇵
S.O.B.A. Dev.
2026-05-10 16:53:20
(1 month ago)
Web vulnerability scanning
Brute-Force
Web Spam
Web App Attack
🇺🇸
xserverx.ru
2026-03-19 10:50:12
(3 months ago)
Honeypot triggered:
IP: 103.4.251.61
Request to: https://xserverx.ru/javascript%3Avoid%280%29
Method ...
show more
Honeypot triggered:
IP: 103.4.251.61
Request to: https://xserverx.ru/javascript%3Avoid%280%29
Method: GET
Host: xserverx.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Referer: Direct
Country: US
ASN: Unknown
Triggered rules: Avoid%280%29
Timestamp: 2026-03-19T10:50:12.353Z
show less
Hacking
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-03-09 22:12:00
(3 months ago)
block ruleset AA06B7315BA6AEB6421B52F0B32E14B509FD5FF0
SQL Injection
🇺🇸
mnsf
2026-03-09 10:05:32
(3 months ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇵🇱
sefinek.net
2026-02-28 10:10:19
(3 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (G ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: / | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇪🇸
gnom4ik
2026-02-22 12:00:08
(3 months ago)
ban-reviewer auto report; ip=103.4.251.61; scenario=http:scan; verdict=valid_ban; confidence=0.90; c ...
show more
ban-reviewer auto report; ip=103.4.251.61; scenario=http:scan; verdict=valid_ban; confidence=0.90; categories=14,15,18; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=scan/exploit pattern detected (http:scan); IP has been banned previously for similar activity; decision made by CAPI with high confidence
show less
Port Scan
Hacking
Brute-Force
🇵🇱
sefinek.net
2026-02-20 23:32:57
(3 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (G ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: / | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
lavnet.net
2026-01-20 07:19:30
(4 months ago)
103.4.251.61 - - [20/Jan/2026:07:19:29 +0000] "GET /https%3A/www.sslshopper.com/ssl-checker.html HTT ...
show more
103.4.251.61 - - [20/Jan/2026:07:19:29 +0000] "GET /https%3A/www.sslshopper.com/ssl-checker.html HTTP/1.1" 404 3042 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36"
103.4.251.61 - - [20/Jan/2026:07:19:29 +0000] "GET /https%3A/zonemaster.net/en/run-test HTTP/1.1" 404 3044 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36"
103.4.251.61 - - [20/Jan/2026:07:19:29 +0000] "GET /https%3A/mxtoolbox.com/domain HTTP/1.1" 404 3042 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36"
103.4.251.61 - - [20/Jan/2026:07:19:29 +0000] "GET /https%3A/lookup.icann.org/ HTTP/1.1" 404 3044 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36"
103.4.251.61 - - [20/Jan/2026:07:19:29 +0000] "GET /https%3A/www.flickr.com/ HTTP/1.1" 404 458 "-" "Mozill
...
show less
Brute-Force
🇫🇷
masterguru
2026-01-01 00:18:52
(5 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 103.4.251.61 (US/United States/-): 1 ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 103.4.251.61 (US/United States/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇩🇪
big-cloud.nl
2025-12-17 17:23:06
(6 months ago)
Try to access /https%3A/meerdrenthe.nl/xmlrpc.php
Web App Attack
🇺🇸
ipblock.com
2025-12-12 20:36:00
(6 months ago)
IPBlock protected site ID [4055-d][s=01].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2025-12-10 17:13:00
(6 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Hacking
Web App Attack