2026-11-11 16:37:25
UTC ·
(4 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇧🇷
Peregrine
2026-11-06 03:12:06
UTC ·
(1 week ago)
Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:09 -0300] "GET /img../.env HTTP/1.1" 404 18149
Bad Web Bot
🇧🇷
Peregrine
2026-11-04 03:12:21
UTC ·
(1 week ago)
Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:09 -0300] "GET /img../.env HTTP/1.1" 404 18149
Bad Web Bot
🇧🇷
Peregrine
2026-11-03 03:11:42
UTC ·
(1 week ago)
Fail2Ban ct101 Jail: tomcat-404 | Evidence: 136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:08 -0300] "GET /dist/.vite/manifest.json HTTP/1.1" 404 18149
136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:08 -0300] "GET /y7kztm63oe7u90o7mdq1 HT ...
show more
Fail2Ban ct101 Jail: tomcat-404 | Evidence: 136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:08 -0300] "GET /dist/.vite/manifest.json HTTP/1.1" 404 18149
136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:08 -0300] "GET /y7kztm63oe7u90o7mdq1 HTTP/1.1" 404 18149
136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:08 -0300] "GET /jtnmxtji1tikveeb7i6z HTTP/1.1" 404 18149
136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:08 -0300] "GET /build/manifest.json HTTP/1.1" 404 18149
136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:08 -0300] "GET /ngsw.json HTTP/1.1" 404 18149
show less
Bad Web Bot
Web App Attack
🇧🇷
dominioz
2026-11-02 16:59:13
UTC ·
(1 week ago)
136.108.160.206 - - [02/Nov/2026:13:59:12 -0300] "GET /settings/webhooks HTTP/1.1" 404 6401 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" "-"
136.108.160.206 - - [02/Nov/2026:13: ...
show more
136.108.160.206 - - [02/Nov/2026:13:59:12 -0300] "GET /settings/webhooks HTTP/1.1" 404 6401 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" "-"
136.108.160.206 - - [02/Nov/2026:13:59:12 -0300] "GET /settings/security HTTP/1.1" 404 6401 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" "-"
136.108.160.206 - - [02/Nov/2026:13:59:12 -0300] "GET /settings/developer HTTP/1.1" 404 6401 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" "-"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-11-02 14:00:19
UTC ·
(1 week ago)
{"level":"info","ts":1793628016.2183275,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.108.160.206","remote_port":"45498","client_ip":"136.108.160.206","proto":"HTTP/2.0","method":"GET","host":"uptime.dentaloffice ...
show more
{"level":"info","ts":1793628016.2183275,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.108.160.206","remote_port":"45498","client_ip":"136.108.160.206","proto":"HTTP/2.0","method":"GET","host":"uptime.dentaloffice.com.br","uri":"/uploads../.env","headers":{"Accept-Encoding":["gzip"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"],"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"uptime.dentaloffice.com.br","ech":false}},"bytes_read":0,"user_id":"","duration":0.00362356,"size":0,"status":429,"resp_headers":{"Retry-After":["1"],"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
{"le
...
show less
DDoS Attack
Web App Attack
🇺🇸
mibbsdevs
2026-11-02 13:46:12
UTC ·
(1 week ago)
(ric-sv) CoffeePot Web: Automated bad bot directory fuzzing and high-rate 404 probing.
Port Scan
Bad Web Bot
🇪🇸
pipeline.es
2026-11-02 13:35:30
UTC ·
(1 week ago)
Web scanning / probing for vulnerable paths | URL: /static/..;/..;/.env | Evidence: geaweb.com.br 136.108.160.206 - - [02/Nov/2026:14:33:34 +0100] \"GET /static/..;/..;/.env HTTP/2.0\" 403 199 \"-\" \"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +htt ...
show more
Web scanning / probing for vulnerable paths | URL: /static/..;/..;/.env | Evidence: geaweb.com.br 136.108.160.206 - - [02/Nov/2026:14:33:34 +0100] \"GET /static/..;/..;/.env HTTP/2.0\" 403 199 \"-\" \"Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)\" GEOIP_COUNTRY_CODE=US 1798 | ASN: GOOGLE-CLOUD-PLATFORM | Country: US
show less
Port Scan
Web App Attack
🇧🇷
govfacil.app
2026-11-02 11:47:15
UTC ·
(1 week ago)
(cpanel) Failed cPanel login from 136.108.160.206 (US/United States/206.160.108.136.bc.googleusercontent.com): 50 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-11-02 08:47:03 -0300] info [cpaneld] 136.108.160.206 ...
show more
(cpanel) Failed cPanel login from 136.108.160.206 (US/United States/206.160.108.136.bc.googleusercontent.com): 50 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-11-02 08:47:03 -0300] info [cpaneld] 136.108.160.206 - - "GET /sitemap.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-11-02 08:47:05 -0300] info [cpaneld] 136.108.160.206 - - "GET /apps/.env HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-11-02 08:47:05 -0300] info [cpaneld] 136.108.160.206 - - "GET /sendgrid.env HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-11-02 08:47:05 -0300] info [cpaneld] 136.108.160.206 - - "GET /v2/.env HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-11-02 08:47:05 -0300] info [cpaneld] 136.108.160.206 - - "GET /.docker/.env HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username
[2026-11-02 08:47:06 -0300] info [cpaneld] 136.108.160.206 - - "GET /env.old HTTP/1.1" FAILED [truncated]
show less
Brute-Force
🇧🇷
dermatovirtual
2026-11-02 07:36:24
UTC ·
(1 week ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 68 unauthorized requests recorded between 2026-11-02 07:15:08 UTC and 2026-11-02 07:15:13 UTC (rate: ~68 req/min). Edge perimete ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 68 unauthorized requests recorded between 2026-11-02 07:15:08 UTC and 2026-11-02 07:15:13 UTC (rate: ~68 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-11-02 07:15:13 UTC] IP: 136.108.160.206 - W3C IIS (Port 443): GET /.env.keys -> HTTP 404 [CLIENT: 136.108.160.206]
[2026-11-02 07:15:13 UTC] IP: 136.108.160.206 - W3C IIS (Port 443): GET /.env.credentials -> HTTP 404 [CLIENT: 136.108.160.206]
[2026-11-02 07:15:13 UTC] IP: 136.108.160.206 - W3C IIS (Port 443): GET /.env.testing -> HTTP 404 [CLIENT: 136.108.160.206]
show less
Bad Web Bot
Web App Attack
🇧🇷
SOC-BR
2026-11-02 07:24:29
UTC ·
(1 week ago)
Attack detected by Fortinet - applications3: Vercel.Next.js.x-middleware-subrequest.Authentication.Bypass - 2026-11-01 22:37:17 - Source Port 41880
Port Scan
Hacking
🇫🇷
mrcrassi
2026-11-02 05:22:53
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /wp-config.php.bak
UA: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 M ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /wp-config.php.bak
UA: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-11-02 04:32:13
UTC ·
(1 week ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇧🇷
Peregrine
2026-11-02 04:13:13
UTC ·
(1 week ago)
Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 136.108.160.206 104.22.118.80 - - [02/Nov/2026:01:13:09 -0300] "GET /img../.env HTTP/1.1" 404 18149
Bad Web Bot
🇧🇷
SvrAdmin
2026-11-02 03:17:53
UTC ·
(1 week ago)
[705] (cpanel) Failed cPanel login from 136.108.160.206 (US/United States/206.160.108.136.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-11-02 00:17:44 -0300] info [webmaild] 136.108.16 ...
show more
[705] (cpanel) Failed cPanel login from 136.108.160.206 (US/United States/206.160.108.136.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-11-02 00:17:44 -0300] info [webmaild] 136.108.160.206 - - "GET /sitemap.xml HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-11-02 00:17:45 -0300] info [webmaild] 136.108.160.206 - - "GET /z9x8c7v6b5-debug-trigger-webmail.masterplanespecialista.com.br HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-11-02 00:17:46 -0300] info [webmaild] 136.108.160.206 - - "GET /laravel/.env HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-11-02 00:17:47 -0300] info [webmaild] 136.108.160.206 - - "POST /api/graphql HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
[2026-11-02 00:17:47 -0300] info [webmaild] 136.108.160.206 - - "GET /.env.swp HTTP/1.1" FAILED LOGIN webmaild: login attempt without username
show less
Port Scan
Hacking
Brute-Force
Exploited Host
