🇺🇸
chrisj
2026-08-02 03:32:11
(28 minutes ago)
[Sun Aug 02 03:32:07.786915 2026] [proxy_fcgi:error] [pid 522585:tid 522637] [client 20.91.199.21:20 ...
show more
[Sun Aug 02 03:32:07.786915 2026] [proxy_fcgi:error] [pid 522585:tid 522637] [client 20.91.199.21:20786] AH01071: Got error 'Primary script unknown'
[Sun Aug 02 03:32:10.431527 2026] [proxy_fcgi:error] [pid 522585:tid 522646] [client 20.91.199.21:20786] AH01071: Got error 'Primary script unknown'
[Sun Aug 02 03:32:10.547108 2026] [proxy_fcgi:error] [pid 522585:tid 522664] [client 20.91.199.21:20786] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
🇭🇺
kranem
2026-08-02 03:00:17
(1 hour ago)
Triggered Cloudflare WAF from SE.
Action taken: BLOCK
ASN: 8075 (Microsoft Corporation)
Protocol: HT ...
show more
Triggered Cloudflare WAF from SE.
Action taken: BLOCK
ASN: 8075 (Microsoft Corporation)
Protocol: HTTP/1.1 (GET method)
Endpoint: /form.php
Timestamp: 2026-08-02T01:43:23Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
Bad Web Bot
🇹🇷
oalver
2026-08-02 02:23:08
(1 hour ago)
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, ...
show more
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_path_signature, nginx_rate_flood. Sources: nginx. Details: path_signature: request to /.tmb/wp-login.php (HTTP 404); 404_flood: 10 requests to /.well-known/acme-challenge/classsmtps.php (HTTP 404) within 60s; rate_flood: 30 requests to /.well-known/kwggvpup.php (HTTP 404) within 10s. First seen: 2026-07-30. Risk score: 100/100.
show less
Web App Attack
2026-08-02 02:22:29
(1 hour ago)
/.tmb/wp-login.php
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-08-02 02:16:55
(1 hour ago)
20.91.199.21 - - [02/Aug/2026:03:16:53 +0100] "GET /cgi-bin/about.php HTTP/1.1" 404 1006 "-" "Mozill ...
show more
20.91.199.21 - - [02/Aug/2026:03:16:53 +0100] "GET /cgi-bin/about.php HTTP/1.1" 404 1006 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
show less
Bad Web Bot
🇩🇪
macrob
2026-08-02 02:05:21
(1 hour ago)
2026/08/02 02:05:19 [error] 82068#82068: *436750526 access forbidden by rule, client: 20.91.199.21, ...
show more
2026/08/02 02:05:19 [error] 82068#82068: *436750526 access forbidden by rule, client: 20.91.199.21, server: finami.ph, request: "GET /.tmb/admin.php HTTP/2.0", host: "www.finami.ph"
2026/08/02 02:05:19 [error] 82068#82068: *436750534 access forbidden by rule, client: 20.91.199.21, server: finami.ph, request: "GET /.tmb/la.php HTTP/2.0", host: "www.finami.ph"
2026/08/02 02:05:20 [error] 82068#82068: *436750537 access forbidden by rule, client: 20.91.199.21, server: finami.ph, request: "GET /.tmb/wp-login.php HTTP/2.0", host: "www.finami.ph"
...
show less
Web App Attack
🇫🇮
Christopher Hughes
2026-08-02 01:35:21
(2 hours ago)
[Sun Aug 02 02:35:19.864987 2026] [proxy_fcgi:error] [pid 2472216:tid 139826510669376] [client 20.91 ...
show more
[Sun Aug 02 02:35:19.864987 2026] [proxy_fcgi:error] [pid 2472216:tid 139826510669376] [client 20.91.199.21:18797] AH01071: Got error 'Primary script unknown'
[Sun Aug 02 02:35:20.797878 2026] [proxy_fcgi:error] [pid 2472216:tid 139826544240192] [client 20.91.199.21:18797] AH01071: Got error 'Primary script unknown'
[Sun Aug 02 02:35:20.885833 2026] [proxy_fcgi:error] [pid 2472216:tid 139824925234752] [client 20.91.199.21:18797] AH01071: Got error 'Primary script unknown'
[Sun Aug 02 02:35:20.963792 2026] [proxy_fcgi:error] [pid 2472216:tid 139826510669376] [client 20.91.199.21:18797] AH01071: Got error 'Primary script unknown'
[Sun Aug 02 02:35:20.999579 2026] [proxy_fcgi:error] [pid 2472216:tid 139825864758848] [client 20.91.199.21:18797] AH01071: Got error 'Primary script unknown'
...
show less
Web App Attack
2026-08-02 01:30:11
(2 hours ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇺🇸
Epimetheus
2026-08-02 01:18:21
(2 hours ago)
Unauthorized access attempts:
[GET] /colors/midnight/priv.php
[GET] /eror.php
[GET] /.well-known/ca ...
show more
Unauthorized access attempts:
[GET] /colors/midnight/priv.php
[GET] /eror.php
[GET] /.well-known/caches.php
[GET] /admin.php
[GET] /ahax.php
[GET] /about.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
Web App Attack
🇺🇸
SX Communications
2026-08-02 01:14:44
(2 hours ago)
Web vulnerability scanning / probing from 20.91.199.21: automated requests for CMS admin paths, logi ...
show more
Web vulnerability scanning / probing from 20.91.199.21: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 4 hits; paths: /.well-known/about.php, /.well-known/elp.php, /.well-known/min.php, /.well-known/pki-validation/min.php.
show less
Port Scan
Hacking
Web App Attack
🇱🇻
garmtech.com
2026-08-02 01:10:53
(2 hours ago)
Attempted access to sensitive endpoint (/cgi-bin/about.php) detected. Automated scan or unauthorized ...
show more
Attempted access to sensitive endpoint (/cgi-bin/about.php) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇫🇷
Tilellit.PRO
2026-08-02 01:07:57
(2 hours ago)
Malicious web traffic detected by CrowdSec
Hacking
🇬🇧
andypiper
2026-08-02 01:02:19
(2 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇩🇪
EGP Abuse Dept
2026-08-02 00:50:38
(3 hours ago)
Scanning for web/db/file exploits on www.dammersbouw.nl
SQL Injection
Bad Web Bot
Web App Attack
🇺🇸
Epimetheus
2026-08-02 00:24:21
(3 hours ago)
Unauthorized access attempts:
[GET] /cloud.php
[GET] /file4.php
[GET] /dropdown.php
[GET] /aaa.php
...
show more
Unauthorized access attempts:
[GET] /cloud.php
[GET] /file4.php
[GET] /dropdown.php
[GET] /aaa.php
[GET] /cgi-bin/about.php
[GET] /colors/blue/info.php
[GET] /.tmb/admin.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
Web App Attack