🇺🇸
kosada.com
2026-10-27 10:39:14
(2 hours ago)
Repeated requests for suspicious nonexistent URLs, for example: /.git-credentials (HTTP/2.0 port 443 ...
show more
Repeated requests for suspicious nonexistent URLs, for example: /.git-credentials (HTTP/2.0 port 443, user agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )")
show less
Web App Attack
🇪🇸
robotstxt
2026-10-27 09:30:42
(3 hours ago)
104.155.225.197 - - [27/Oct/2026:09:29:41 +0000] "GET /robots.txt HTTP/2.0" 403 137 "-" "Mozilla/5.0 ...
show more
104.155.225.197 - - [27/Oct/2026:09:29:41 +0000] "GET /robots.txt HTTP/2.0" 403 137 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" edge="104.155.225.197"
104.155.225.197 - - [27/Oct/2026:09:29:42 +0000] "GET /sitemap.xml HTTP/2.0" 403 20 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )" "-" edge="104.155.225.197"
104.155.225.197 - - [27/Oct/2026:09:29:43 +0000] "GET /sitemap_index.xml HTTP/2.0" 403 20 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" "-" edge="104.155.225.197"
104.155.225.197 - - [27/Oct/2026:09:29:43 +0000] "GET /z9x8c7v6b5-debug-trigger-test.ccoocaixabank.net HTTP/2.0" 403 20 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@ant
...
show less
Web App Attack
🇳🇱
Site.eu
2026-10-27 07:16:09
(5 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-27 04:05:21
(9 hours ago)
{"level":"info","ts":1793073918.4535928,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1793073918.4535928,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.155.225.197","remote_port":"49562","client_ip":"104.155.225.197","proto":"HTTP/2.0","method":"GET","host":"status.bsi-mt.net","uri":"/asset-manifest.json","headers":{"Upgrade-Insecure-Requests":["1"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Google Chrome\";v=\"152\""],"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Dest":["document"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Ch-Ua-Mobile":["?1"],"Sec-Fetch-User":["?1"],"Sec-Ch-Ua-Platform":["\"Android\""],"Priority":["u=0, i"],"Sec-Fetch-Site":["none"],"Accept-Language":["en-US,en;q=0.9"],"Accept":["text
...
show less
DDoS Attack
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-26 22:59:22
(14 hours ago)
Auto-ban: >3000 req/min op 2026-10-26
Web App Attack
SSH
Hacking
🇩🇪
ghostwarriors
2026-10-26 20:50:09
(16 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-10-26 20:40:15
(16 hours ago)
104.155.225.197 - - [26/Oct/2026:21:40:13 +0100] "GET /letter_opener HTTP/2.0" 404 303 "-" "Mozilla/ ...
show more
104.155.225.197 - - [26/Oct/2026:21:40:13 +0100] "GET /letter_opener HTTP/2.0" 404 303 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
104.155.225.197 - - [26/Oct/2026:21:40:13 +0100] "GET /settings/integrations HTTP/2.0" 404 303 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
104.155.225.197 - - [26/Oct/2026:21:40:13 +0100] "GET /backoffice/dashboard HTTP/2.0" 404 303 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
104.155.225.197 - - [26/Oct/2026:21:40:13 +0100] "GET /settings/webhooks HTTP/2.0" 404 303 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"
104.155.225.197 - - [26/Oct/2026:21:40:13 +0100] "GET /account/settings HTTP/2.0" 404 303 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like
show less
Bad Web Bot
🇬🇧
consul.to
2026-10-26 20:38:56
(16 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇧🇪
boxed-it
2026-10-26 19:15:18
(17 hours ago)
GET /console (Tarpitted for 11s, wasted 720B)
Web App Attack
🇩🇪
Bedios GmbH
2026-10-26 18:50:00
(18 hours ago)
Scanning for exposed credentials and private keys.
Hacking
🇳🇱
Alt255
2026-10-26 14:55:11
(22 hours ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.155.225.197 - - \[26/Oct/2026:15:54:54 +0100\] "GET /.env.development\?import\&raw HTTP/1.1" 403 4702 "-" "Mozilla/5.0 \(compatible\; Amazonbot/0.1\; +https://developer.amazon.com/support/amazonbot\)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-26 14:38:54
(22 hours ago)
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 104.155.225.197 (TW/Taiwan/197.2 ...
show more
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 104.155.225.197 (TW/Taiwan/197.225.155.104.bc.googleusercontent.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇳🇱
Eric
2026-10-26 14:33:41
(22 hours ago)
[Mon Oct 26 14:33:40.444880 2026] [security2:error] [pid 1113000:tid 1113000] [client 104.155.225.19 ...
show more
[Mon Oct 26 14:33:40.444880 2026] [security2:error] [pid 1113000:tid 1113000] [client 104.155.225.197:50486] [client 104.155.225.197] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "fambus.nl"] [uri "/"] [unique_id "at9kxDbYPUranoTG8kubsAAAADA"]
[Mon Oct 26 14:33:40.515198 2026] [security2:error] [pid 1153168:tid 1153168] [client 104.155.225.197:50524] [client 104.155.225.197] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [se
...
show less
Hacking
Web App Attack
🇳🇱
debestelapp
2026-10-26 14:30:11
(22 hours ago)
Web App Attack
🇳🇱
Savvii
2026-10-26 14:25:54
(22 hours ago)
20 attempts against mh-misbehave-ban on comet
Brute-Force
Bad Web Bot
Web App Attack