🇬🇧
andypiper
2026-07-15 01:02:32
(3 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
raph
2026-07-15 00:12:17
(4 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
2026-07-14 18:42:43
(10 hours ago)
(caddyscan) Scanner path probe from 104.28.205.81 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 104.28.205.81 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.28.205.81 - - [14/Jul/2026:18:42:41 +0000] "GET /.aws/credentials HTTP/1.1"
[REDACTED] 200 2627 104.28.205.81 - - [14/Jul/2026:18:42:41 +0000] "GET /.aws/config HTTP/1.1"
[REDACTED] 200 2627 104.28.205.81 - - [14/Jul/2026:18:42:41 +0000] "GET /.env HTTP/1.1"
[REDACTED] 200 2627 104.28.205.81 - - [14/Jul/2026:18:42:41 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 104.28.205.81 - - [14/Jul/2026:18:42:41 +0000] "GET /.git/HEAD HTTP/1.1"
show less
Port Scan
🇬🇧
Celtic
2026-07-14 16:43:12
(12 hours ago)
Blocked by Fail2Ban with Jail (plesk-modsecurity)
Brute-Force
SSH
🇺🇸
Matthew Ping
2026-07-14 06:15:01
(22 hours ago)
ModSecurity rule 949110 triggered on wp2. Web application attack blocked by CSF/LFD.
Web App Attack
Hacking
2026-07-14 00:49:36
(1 day ago)
Aggressive web scan
Web App Attack
🇺🇸
JustMeHere
2026-07-13 19:20:21
(1 day ago)
[Mon Jul 13 15:20:17.027403 2026] [security2:error] [pid 1243:tid 1287] [client 104.28.205.81:9881] ...
show more
[Mon Jul 13 15:20:17.027403 2026] [security2:error] [pid 1243:tid 1287] [client 104.28.205.81:9881] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "yorknation.com"] [uri "/rclone.conf"] [unique_id "alU6cQboBkY1-jaIUrsshwAAANA"]
...
show less
Web App Attack
🇬🇧
noise.agency
2026-07-13 19:17:24
(1 day ago)
104.28.205.81 (US/United States/-), more than 10 Apache 403 hits
Hacking
🇦🇺
paulshipley.com.au
2026-07-13 17:50:13
(1 day ago)
[Tue Jul 14 03:50:12.628418 2026] [security2:error] [pid 140449] [client 104.28.205.81:17883] [clien ...
show more
[Tue Jul 14 03:50:12.628418 2026] [security2:error] [pid 140449] [client 104.28.205.81:17883] [client 104.28.205.81] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/rclone.conf"] [unique_id "alUlVFjobwPr3-iWzbIpfwAAAAA"]
...
show less
Web App Attack
🇫🇷
Octopuce
2026-07-13 06:26:02
(1 day ago)
Aggressive web search of vulnerable pages: /.env /config/.env /backend/.env /admin/.env /.hermes/.en ...
show more
Aggressive web search of vulnerable pages: /.env /config/.env /backend/.env /admin/.env /.hermes/.env ...
show less
Web App Attack
🇩🇪
NihiliousMonk
2026-07-12 16:19:51
(2 days ago)
Fail2Ban report from jail npm-scanners
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-07-12 14:48:09
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
FeG Deutschland
2026-07-12 14:29:13
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇫🇷
Lacrimosa99
2026-07-12 10:07:53
(2 days ago)
104.28.205.81 - - [12/Jul/2026:12:07:51 +0200] "GET /admin HTTP/2.0" 404 224 "-" "Mozilla/5.0 (iPad; ...
show more
104.28.205.81 - - [12/Jul/2026:12:07:51 +0200] "GET /admin HTTP/2.0" 404 224 "-" "Mozilla/5.0 (iPad; CPU OS 26_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1"
104.28.205.81 - - [12/Jul/2026:12:07:53 +0200] "GET /firebase-adminsdk.json HTTP/2.0" 404 224 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user"
104.28.205.81 - - [12/Jul/2026:12:07:53 +0200] "GET /admin/.env HTTP/2.0" 404 224 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Web Spam
🇩🇪
Bedios GmbH
2026-07-12 09:12:20
(2 days ago)
Login credentials theft attempt
Hacking