🇳🇱
Site.eu
2026-10-11 18:39:10
(10 minutes ago)
Excessive multi-domain requests
Brute-Force
🇪🇸
el-brujo
2026-10-11 18:03:53
(46 minutes ago)
Cloudflare WAF: Request Path: /id_ed25519 Request Query: Host: status.elhacker.net userAgent: Mozil ...
show more
Cloudflare WAF: Request Path: /id_ed25519 Request Query: Host: status.elhacker.net userAgent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Action: block Source: firewallCustom ASN Description: Google LLC Country: BE Method: GET Timestamp: 2026-10-11T18:03:53Z ruleId: 6b2d48d0415e4adb9f099d85f54d1de6. Report generated by Cloudflare-WAF-to-AbuseIPDB.
show less
Hacking
SQL Injection
Web App Attack
🇩🇪
updown.io
2026-10-11 18:02:39
(47 minutes ago)
{"level":"info","ts":1791741757.605356,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1791741757.605356,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.14.77.228","remote_port":"54136","client_ip":"34.14.77.228","proto":"HTTP/2.0","method":"GET","host":"status.assertz.net","uri":"/","headers":{"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Fetch-User":["?1"],"Sec-Fetch-Site":["none"],"Accept-Language":["en-US,en;q=0.9"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Fetch-Mode":["navigate"],"Sec-Ch-Ua-Mobile":["?0"],"X-Nextjs-Data":["1"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml
...
show less
DDoS Attack
Web App Attack
🇩🇪
pscriptos
2026-10-11 13:47:20
(5 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
mzaiser12
2026-10-11 13:14:28
(5 hours ago)
Web application probing: 108 requests to typical attack paths (/.env.development?import&raw, /.env.l ...
show more
Web application probing: 108 requests to typical attack paths (/.env.development?import&raw, /.env.live, /.env.local::$DATA?raw, /.env.development::$DATA?raw) within 5 min. Reported automatically by a SIEM; contact via abuse mailbox of the reporting network.
show less
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2026-10-11 10:57:35
(7 hours ago)
Cloudflare WAF: Request Path: /api/system/fileView Request Query: ?file=/proc/self/environ Host: met ...
show more
Cloudflare WAF: Request Path: /api/system/fileView Request Query: ?file=/proc/self/environ Host: metrics.elhacker.net userAgent: Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) Action: block Source: zonelockdown ASN Description: Google LLC Country: BE Method: GET Timestamp: 2026-10-11T10:57:35Z ruleId: 4ff0e8626c0f4b8e8c318b9cdf01b0d9. Report generated by Cloudflare-WAF-to-AbuseIPDB.
show less
Hacking
SQL Injection
Web App Attack
🇪🇸
el-brujo
2026-10-11 09:58:02
(8 hours ago)
11/Oct/2026:11:58:01.963687 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
11/Oct/2026:11:58:01.963687 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.14.77.228] ModSecurity: Warning. Pattern match "(?i)(?:\\\\\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "mail.elhacker.net"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 09:54:34
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.14.77.228 (228.77.14.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.14.77.228 (228.77.14.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 05:54:29.654780 2026] [security2:error] [pid 31731:tid 31731] [client 34.14.77.228:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.assistguide.net|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.assistguide.net"] [uri "/rclone.conf"] [unique_id "astc1VRf7D2sb9ANkyvQIwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-11 09:54:01
(8 hours ago)
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Examp ...
show more
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.14.77.228 - - [11/Oct/2026:11:54:00 +0200] "GET /api/system/fileView?file=/app/.env HTTP/2.0" 404 1422 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
Charlesiv
2026-10-11 08:01:36
(10 hours ago)
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /cms/.env
Timestamp: 2026-10-11T07:36:07Z
Ray ID: a48c31257e54c72b
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )
show less
Bad Web Bot
🇩🇪
itsolon
2026-10-11 07:41:54
(11 hours ago)
[11/Oct/2026:09:41:53 +0200] 179170451317.122124 34.14.77.228 0 217.154.7.177 443
[11/Oct/2026:09:41 ...
show more
[11/Oct/2026:09:41:53 +0200] 179170451317.122124 34.14.77.228 0 217.154.7.177 443
[11/Oct/2026:09:41:53 +0200] 179170451372.460854 34.14.77.228 0 217.154.7.177 443
[11/Oct/2026:09:41:53 +0200] 179170451328.453218 34.14.77.228 0 217.154.7.177 443
[11/Oct/2026:09:41:53 +0200] 179170451370.081395 34.14.77.228 0 217.154.7.177 443
[11/Oct/2026:09:41:53 +0200] 179170451393.299485 34.14.77.228 0 217.154.7.177 443
...
show less
Port Scan
Hacking
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-11 07:28:39
(11 hours ago)
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ...
show more
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.14.77.228 - - [11/Oct/2026:09:28:34 +0200] "GET /signup HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.14.77.228 - - [11/Oct/2026:09:28:34 +0200] "GET /panel HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.14.77.228 - - [11/Oct/2026:09:28:34 +0200] "GET /admin HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.14.77.228 - - [11/Oct/2026:09:28:34 +0200] "GET /z9x8c7v6b5-debug-trigger-h01.alt255.net HTTP/2.0" 404 1855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); co
...
show less
Bad Web Bot
Web App Attack
🇫🇷
UnixPrime
2026-10-11 07:03:07
(11 hours ago)
34.14.77.228 - - [11/Oct/2026:09:03:06 +0200] "GET /.env.production HTTP/1.1" 404 4149 "-" "Mozilla/ ...
show more
34.14.77.228 - - [11/Oct/2026:09:03:06 +0200] "GET /.env.production HTTP/1.1" 404 4149 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.14.77.228 - - [11/Oct/2026:09:03:06 +0200] "GET /.env.local HTTP/1.1" 404 4143 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
curiosity
2026-10-11 07:02:06
(11 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-crawl-non_statics
Web App Attack
Bad Web Bot
🇩🇪
webanyone
2026-10-11 06:57:49
(11 hours ago)
Wordlist path sweep | method: GET | path: /assets/manifest.json, /webpack-stats.json, /gjdpuvnmnygv7 ...
show more
Wordlist path sweep | method: GET | path: /assets/manifest.json, /webpack-stats.json, /gjdpuvnmnygv7ho9dyxk (+3 more) | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36, DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot), Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)
show less
Port Scan
Web App Attack
