2026-10-10 01:12:33
(1 week ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Clou ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Cloud secrets probing, Directory traversal
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-09 21:59:52
(1 week ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-08.
show less
Web App Attack
SSH
Hacking
🇿🇦
conure.sh
2026-10-09 12:00:18
(1 week ago)
csagent: score 20.0: secrets grab x2; 1 domain(s) in 4s
Web App Attack
🇳🇱
Alt255
2026-10-09 05:50:16
(1 week ago)
[cb-03al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-03al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.10.31.188 - - [09/Oct/2026:07:50:01 +0200] "GET /assets../.env HTTP/2.0" 404 343 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"
...
show less
Bad Web Bot
Web App Attack
🇪🇸
robotstxt
2026-10-09 05:36:31
(1 week ago)
34.10.31.188 - - [09/Oct/2026:05:35:55 +0000] "GET /.vite/manifest.json HTTP/2.0" 403 2 "https://sta ...
show more
34.10.31.188 - - [09/Oct/2026:05:35:55 +0000] "GET /.vite/manifest.json HTTP/2.0" 403 2 "https://starship.xyz/.vite/manifest.json" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "-" edge="34.10.31.188"
34.10.31.188 - - [09/Oct/2026:05:35:55 +0000] "GET /z9x8c7v6b5-debug-trigger-starship.xyz HTTP/2.0" 403 20 "https://starship.xyz/z9x8c7v6b5-debug-trigger-starship.xyz" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" "-" edge="34.10.31.188"
34.10.31.188 - - [09/Oct/2026:05:35:55 +0000] "GET /dist/manifest.json HTTP/2.0" 403 2 "https://starship.xyz/dist/manifest.json" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "-" edge="34.10.31.188"
34.10.31.188 - - [09/Oct/2026:05:35:55 +0000] "GET /dist/.vite/manifest.json HTTP/2.0" 403 2 "https://starship.xyz/dist/.vite/manifest.json"
...
show less
Web App Attack
🇩🇪
Skyrider
2026-10-09 05:32:20
(1 week ago)
Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 05:31:14
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.10.31.188 (188.31.10.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.10.31.188 (188.31.10.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 01:31:08.379724 2026] [security2:error] [pid 7052:tid 7052] [client 34.10.31.188:59088] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||silsby.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "silsby.com"] [uri "/z9x8c7v6b5-debug-trigger-silsby.com"] [unique_id "ash8HAi9z2Y7oKQHkIwSWAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2026-10-09 05:21:08
(1 week ago)
Attack against Apache (too many 404s)
Web App Attack
🇬🇧
openstrike.co.uk
2026-10-09 05:15:31
(1 week ago)
147 attacks on env grabbing URLs, shell probes, VC URLs, config grabbing URLs (type 2), directory tr ...
show more
147 attacks on env grabbing URLs, shell probes, VC URLs, config grabbing URLs (type 2), directory traversals, PHP URLs, password/key grabbing URLs, env grabbing URLs (type 2):
GET /static/../../../a/../../../../.env HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /secrets.yml HTTP/1.1
GET /..%2f..%2f.env HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
GET /.ssh/id_ed25519 HTTP/1.1
GET /proc/self/cmdline HTTP/1.1
show less
Hacking
Web App Attack
🇺🇸
infra-monitor
2026-10-09 05:00:04
(1 week ago)
Automated ban via infra-monitor: suspicious-probe, mgmt-path-probe, crowdsecurity/http-cve-2021-4177 ...
show more
Automated ban via infra-monitor: suspicious-probe, mgmt-path-probe, crowdsecurity/http-cve-2021-41773, +5 more
show less
Port Scan
Hacking
Bad Web Bot
Web App Attack
🇫🇷
phoenix1jl96
2026-10-09 04:38:46
(1 week ago)
2026/10/09 06:38:45 [error] 4800#4800: *64333 open() "/home/user-data/www/default/cgi-bin/php-cgi.ex ...
show more
2026/10/09 06:38:45 [error] 4800#4800: *64333 open() "/home/user-data/www/default/cgi-bin/php-cgi.exe" failed (2: No such file or directory), client: 34.10.31.188, server: box.ledemon.us, request: "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "ledemon.us"
2026/10/09 06:38:46 [error] 4800#4800: *64333 open() "/home/user-data/www/default/cgi-bin/php" failed (2: No such file or directory), client: 34.10.31.188, server: box.ledemon.us, request: "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇺🇸
kbeezie
2026-10-09 04:31:15
(1 week ago)
34.10.31.188 - - [09/Oct/2026:00:31:14 -0400] "GET /wp-json HTTP/1.1" 429 162 "-" "Mozilla/5.0 (comp ...
show more
34.10.31.188 - - [09/Oct/2026:00:31:14 -0400] "GET /wp-json HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.10.31.188 - - [09/Oct/2026:00:31:14 -0400] "GET /__/firebase/init.json HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
34.10.31.188 - - [09/Oct/2026:00:31:14 -0400] "GET /config.json HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.10.31.188 - - [09/Oct/2026:00:31:14 -0400] "GET /api/config HTTP/1.1" 429 162 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
34.10.31.188 - - [09/Oct/2026:00:31:14 -0400] "GET /api/v2/settings HTTP/1.1" 429 162 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 04:27:32
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.10.31.188 (188.31.10.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.10.31.188 (188.31.10.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 00:27:27.153366 2026] [security2:error] [pid 29330:tid 29330] [client 34.10.31.188:36572] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jonathanwilson.me"] [uri "/media../.env"] [unique_id "ashtL8SkamuYL084dzBsYQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-09 03:36:29
(1 week ago)
20 attempts against mh-misbehave-ban on onion
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 03:31:59
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.10.31.188 (188.31.10.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.10.31.188 (188.31.10.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 23:31:55.380610 2026] [security2:error] [pid 28371:tid 28371] [client 34.10.31.188:57692] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jimhermelband.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jimhermelband.com"] [uri "/z9x8c7v6b5-debug-trigger-jimhermelband.com"] [unique_id "ashgK8_RmtA_uqa8tWsojwAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
