🇩🇰
ScamAware
2026-06-12 02:55:56
(1 week ago)
Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ...
show more
Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 92. Unique request paths counted internally: 92. Cloudflare action: block. Cloudflare source: firewallCustom.
show less
Web App Attack
🇳🇱
e.fierstra
2026-06-12 00:04:03
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-06-11 20:10:39
(1 week ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 34.126.203.204 (AU/Austr ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 34.126.203.204 (AU/Australia/204.203.126.34.bc.googleusercontent.com)
show less
Port Scan
🇳🇱
Cloud86 B.V.
2026-06-11 15:00:06
(1 week ago)
categories: DDoS Attack
DDoS Attack
🇬🇧
consul.to
2026-06-11 00:40:56
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
Philister11
2026-06-11 00:20:33
(1 week ago)
CrowdSec: crowdsecurity/http-probing (AU/AS396982)
Web App Attack
Hacking
🇳🇱
Site.eu
2026-06-10 22:50:03
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
e.fierstra
2026-06-10 21:39:06
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
2026-06-10 18:52:43
(1 week ago)
(caddyscan) Scanner path probe from 34.126.203.204 (AU/Australia/204.203.126.34.bc.googleusercontent ...
show more
(caddyscan) Scanner path probe from 34.126.203.204 (AU/Australia/204.203.126.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:18:52:40 +0000] "GET /api/actuator/heapdump HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:18:52:40 +0000] "GET /actuator/threaddump HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:18:52:40 +0000] "GET /app/actuator/logfile HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:18:52:40 +0000] "GET /actuator/sessions HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:18:52:40 +0000] "GET /actuator/logfile HTTP/1.1"
show less
Port Scan
🇳🇱
Roderic
2026-06-10 17:52:51
(1 week ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted])
Bad Web Bot
🇫🇷
masterguru
2026-06-10 14:15:21
(1 week ago)
Restricted File Access Attempt. Matched phrase "credentials.json" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇬🇧
Yosi
2026-06-10 10:48:24
(1 week ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇩🇪
updown.io
2026-06-10 10:30:52
(1 week ago)
{"level":"info","ts":1781087451.1529753,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1781087451.1529753,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.126.203.204","remote_port":"40630","client_ip":"34.126.203.204","proto":"HTTP/1.1","method":"GET","host":"ponmlonmlkjihgfedgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/v1/actuator/env","headers":{"Accept-Encoding":["gzip"],"Connection":["close"],"User-Agent":["Mozilla/5.0 (Linux; Android 6.0; NCE-AL00 Build/HUAWEINCE-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044813 Mobile Safari/537.36 MMWEBID/6904 MicroMessenger/7.0.6.1460(0x27000634) Process/tools NetType/4G Language/zh_CN"],"Accept-Charset":["utf-8"]}},"bytes_read":0,"user_id":"","duration":0.000034946,"size":0,"status":308,"resp_headers":{"Location":["https://ponmlonmlkjihgfedgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/v1/actuator/env"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}}
{"leve
...
show less
DDoS Attack
Web App Attack
2026-06-10 07:48:00
(1 week ago)
(caddyscan) Scanner path probe from 34.126.203.204 (AU/Australia/204.203.126.34.bc.googleusercontent ...
show more
(caddyscan) Scanner path probe from 34.126.203.204 (AU/Australia/204.203.126.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:07:47:58 +0000] "GET /v2/actuator/env HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:07:47:58 +0000] "GET /config/.aws/credentials HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:07:47:58 +0000] "GET /api/actuator/configprops HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:07:47:58 +0000] "GET /actuator/env HTTP/1.1"
[REDACTED] 200 2627 34.126.203.204 - - [10/Jun/2026:07:47:58 +0000] "GET /.aws/config HTTP/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-10 07:37:18
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.126.203.204 (204.203.126.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.126.203.204 (204.203.126.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 03:37:11.202326 2026] [security2:error] [pid 29514:tid 29514] [client 34.126.203.204:33492] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||billdavidow.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "billdavidow.com"] [uri "/backup.sql"] [unique_id "aikUJ98rOMEgIn5WdwcqSgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack