🇺🇸
Charlesiv
2026-10-12 00:08:54
(2 hours ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /.//.env
Timestamp: 2026-10-11T23:00:50Z
Ray ID: a4917bb86c919df9
UA: Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)
show less
Bad Web Bot
🇩🇪
pscriptos
2026-10-11 22:21:37
(4 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
updown.io
2026-10-11 22:14:52
(4 hours ago)
{"level":"info","ts":1791756890.6247926,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791756890.6247926,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.141.181.0","remote_port":"38392","client_ip":"34.141.181.0","proto":"HTTP/2.0","method":"POST","host":"status.anw.net","uri":"/graphql","headers":{"Accept":["*/*"],"Sec-Fetch-Mode":["cors"],"Sec-Fetch-Site":["same-origin"],"Sec-Ch-Ua-Platform":["\"Windows\""],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Sec-Fetch-Dest":["empty"],"Content-Type":["application/json"],"Referer":["https://status.anw.net"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua-Mobile":["?0"],"Origin":["https://status.anw.net"],"Content-Length":["86"],"Priority":["u=1, i"],"Accept-Encoding":["gzip, deflate, br, zstd"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.anw.net","ech":fals
...
show less
DDoS Attack
Web App Attack
🇳🇱
Site.eu
2026-10-11 22:07:02
(4 hours ago)
Excessive multi-domain requests
Brute-Force
🇩🇪
raph
2026-10-11 21:37:28
(5 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇸🇮
administrator
2026-10-11 16:02:00
(10 hours ago)
2026-10-11 18:02:00,055 fail2ban.actions [1080]: NOTICE [apache-botsearch] Ban 34.141.181.0
...
show more
2026-10-11 18:02:00,055 fail2ban.actions [1080]: NOTICE [apache-botsearch] Ban 34.141.181.0
2026-10-11 18:02:00,176 fail2ban.actions [1080]: NOTICE [apache-badbots] Ban 34.141.181.0
2026-10-11 18:02:00,204 fail2ban.actions [1080]: NOTICE [error-bots] Ban 34.141.181.0
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
🇪🇸
el-brujo
2026-10-11 14:08:21
(12 hours ago)
11/Oct/2026:16:08:20.746473 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
11/Oct/2026:16:08:20.746473 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.141.181.0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "parrot.elhacker.net"] [uri "/.env"] [unique_id "asuYVCPDE8k24URB7UFlGQABZgM"]
...
show less
Hacking
Web App Attack
🇩🇪
mzaiser12
2026-10-11 13:53:22
(12 hours ago)
Web application probing: 109 requests to typical attack paths (/.env?import&raw, /.env?raw, /@fs/..% ...
show more
Web application probing: 109 requests to typical attack paths (/.env?import&raw, /.env?raw, /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??, /.env.live) within 5 min. Reported automatically by a SIEM; contact via abuse mailbox of the reporting network.
show less
Bad Web Bot
Web App Attack
🇺🇸
Charlesiv
2026-10-11 12:07:41
(14 hours ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /
Timestamp: 2026-10-11T09:36:21Z
Ray ID: a48ce1458d635a40
UA: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)
show less
Bad Web Bot
2026-10-11 11:09:59
(15 hours ago)
CrowdSec detection: crowdsecurity/http-sensitive-files
Web App Attack
🇪🇸
el-brujo
2026-10-11 10:46:05
(16 hours ago)
11/Oct/2026:12:46:05.474837 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
11/Oct/2026:12:46:05.474837 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.141.181.0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ns2.elhacker.net"] [uri "/rclone.conf"] [unique_id
...
show less
Hacking
Web App Attack
🇿🇦
conure.sh
2026-10-11 10:39:32
(16 hours ago)
csagent: score 21.2: 404 noise floor x5, secrets grab x2; 1 domain(s) in 2s
Web App Attack
🇺🇸
Starburst SysOp Team
2026-10-11 10:34:08
(16 hours ago)
. Matched phrase "/.env" at REQUEST_URI. (210492-srv1)
Web App Attack
🇪🇸
el-brujo
2026-10-11 09:07:01
(17 hours ago)
Cloudflare WAF: Request Path: /.boto Request Query: Host: metrics.elhacker.net userAgent: Mozilla/5 ...
show more
Cloudflare WAF: Request Path: /.boto Request Query: Host: metrics.elhacker.net userAgent: Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler) Action: block Source: zonelockdown ASN Description: Google LLC Country: NL Method: GET Timestamp: 2026-10-11T09:07:01Z ruleId: 4ff0e8626c0f4b8e8c318b9cdf01b0d9. Report generated by Cloudflare-WAF-to-AbuseIPDB.
show less
Hacking
SQL Injection
Web App Attack
🇫🇷
masterguru
2026-10-11 08:14:59
(18 hours ago)
BAD BOT - Detected and Blocked.. Matched phrase "PerplexityBot" at REQUEST_HEADERS:user-agent. (1100 ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "PerplexityBot" at REQUEST_HEADERS:user-agent. (1100000-131)
show less
Bad Web Bot
