🇭🇺
kranem
2026-11-12 09:00:34
UTC ·
(4 hours ago)
Triggered Cloudflare WAF from SG.
Action taken: BLOCK
ASN: 14061 (DigitalOcean, LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: //cache/cache/cache.php
Timestamp: 2026-11-12T07:01:38Z
User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; ...
show more
Triggered Cloudflare WAF from SG.
Action taken: BLOCK
ASN: 14061 (DigitalOcean, LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: //cache/cache/cache.php
Timestamp: 2026-11-12T07:01:38Z
User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
show less
Bad Web Bot
🇩🇪
todix
2026-11-12 07:12:08
UTC ·
(5 hours ago)
"GET /images/images/cache.php HTTP/1.1" 404 74743 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
Bad Web Bot
🇮🇹
VHosting
2026-11-12 06:25:04
UTC ·
(6 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
infra-monitor
2026-11-12 05:00:06
UTC ·
(8 hours ago)
Automated ban via infra-monitor: crowdsecurity/http-bad-user-agent
Bad Web Bot
🇦🇺
Proxay Fox
2026-11-12 03:57:08
UTC ·
(9 hours ago)
167.71.203.8 - - [12/Nov/2026:13:54:52 +1000] "GET / HTTP/2.0" 403 166 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "167.71 ...
show more
167.71.203.8 - - [12/Nov/2026:13:54:52 +1000] "GET / HTTP/2.0" 403 166 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "167.71.203.8" 424 607 TLSv1.3/TLS_AES_256_GCM_SHA384 . 98919ad8e17d773c826f58620113566a5f1563b2af48f49f7a075b273f3192df
167.71.203.8 - - [12/Nov/2026:13:55:02 +1000] "GET / HTTP/2.0" 403 166 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "167.71.203.8" 35 607 TLSv1.3/TLS_AES_256_GCM_SHA384 . 98919ad8e17d773c826f58620113566a5f1563b2af48f49f7a075b273f3192df
167.71.203.8 - - [12/Nov/2026:13:55:19 +1000] "GET / HTTP/2.0" 403 166 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "167.71.203.8" 425 607 TLSv1
...
show less
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-12 03:00:13
UTC ·
(10 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
🇩🇪
london2038.com
2026-11-12 02:19:54
UTC ·
(10 hours ago)
Probing for exploits
167.71.203.8 - - [12/Nov/2026:03:19:46 +0100] "GET //images/images/cache.php HTTP/1.1" 204 0 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/ ...
show more
Probing for exploits
167.71.203.8 - - [12/Nov/2026:03:19:46 +0100] "GET //images/images/cache.php HTTP/1.1" 204 0 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
167.71.203.8 - - [12/Nov/2026:03:19:50 +0100] "GET //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1" 204 0 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
show less
Hacking
Web App Attack
🇩🇪
23p02732
2026-11-12 02:18:24
UTC ·
(10 hours ago)
Automated web scanning and malicious probing
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
eagle
2026-11-12 02:06:07
UTC ·
(10 hours ago)
167.71.203.8 - - [12/Nov/2026:02:04:20 +0000] "GET //images/images/cache.php HTTP/1.1" 404 207 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobli ...
show more
167.71.203.8 - - [12/Nov/2026:02:04:20 +0000] "GET //images/images/cache.php HTTP/1.1" 404 207 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "[server]"
167.71.203.8 - - [12/Nov/2026:02:04:25 +0000] "GET //cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php HTTP/1.1" 404 207 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "[server]"
167.71.203.8 - - [12/Nov/2026:02:04:40 +0000] "GET //images/images/images/images/images/images/images/images/cache.php HTTP/1.1" 404 207 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "[server]"
167.71.203.8 - - [12/Nov/2026:02:04:56 +0000] "GET //images/images/images/images/images/images/images/cach
...
show less
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-11-12 02:01:39
UTC ·
(10 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
Michel Wijnberg
2026-11-12 01:12:16
UTC ·
(11 hours ago)
167.71.203.8 - - [12/Nov/2026:01:12:16 +0000] "GET //images/images/cache.php HTTP/1.1" 301 162 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobli ...
show more
167.71.203.8 - - [12/Nov/2026:01:12:16 +0000] "GET //images/images/cache.php HTTP/1.1" 301 162 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-11-12 00:15:56
UTC ·
(12 hours ago)
BAD BOT - Detected and Blocked.. Matched phrase "mozlila" at REQUEST_HEADERS:User-Agent. (1100000-201)
Bad Web Bot
🇩🇪
33three
2026-11-11 22:29:43
UTC ·
(14 hours ago)
Fail2Ban jail WebAttack triggered
Brute-Force
🇩🇪
AetherFox
2026-11-11 22:20:57
UTC ·
(14 hours ago)
AetherFox VoidGuard detected: [Wed Nov 11 22:20:13.771690 2026] [security2:error] [pid 3043307:tid 3043318] [client 167.71.203.8:51491] [client 167.71.203.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(Mozlila|Bulid|Moblie)" a ...
show more
AetherFox VoidGuard detected: [Wed Nov 11 22:20:13.771690 2026] [security2:error] [pid 3043307:tid 3043318] [client 167.71.203.8:51491] [client 167.71.203.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(Mozlila|Bulid|Moblie)" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/AetherFox.conf"] [line "89"] [id "100066"] [msg "typo-fingerprint UA blocked by AetherFox VoidGuard"] [tag "custom-blocklist"] [hostname "draconigen.net"] [uri "/images/images/cache.php"] [unique_id "avTqHbeHCQ6NvrDLjmaQYAAAAEk"], referer: www.google.com
[Wed Nov 11 22:20:26.748773 2026] [security2:error] [pid 3043307:tid 3043314] [client 167.71.203.8:52151] [client 167.71.203.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(Mozlila|Bulid|Moblie)" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/AetherFox.conf"] [line "89"] [id "100066"] [msg "typo-fingerprint UA blocked by AetherFox VoidGuard"] [tag "custom-blocklist"] [hostname "draconige
...
show less
Hacking
Bad Web Bot
Anonymous
2026-11-11 20:10:08
UTC ·
(16 hours ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot