🇳🇱
Site.eu
2026-10-11 22:52:06
(1 day ago)
Excessive multi-domain requests
Brute-Force
🇪🇸
el-brujo
2026-10-11 14:25:21
(1 day ago)
Cloudflare WAF: Request Path: /dist../.env Request Query: Host: wiki.elhacker.net userAgent: Mozill ...
show more
Cloudflare WAF: Request Path: /dist../.env Request Query: Host: wiki.elhacker.net userAgent: Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) Action: block Source: firewallCustom ASN Description: Google LLC Country: DE Method: GET Timestamp: 2026-10-11T14:25:21Z ruleId: 6b2d48d0415e4adb9f099d85f54d1de6. Report generated by Cloudflare-WAF-to-AbuseIPDB.
show less
Hacking
SQL Injection
Web App Attack
🇩🇪
pscriptos
2026-10-11 12:56:24
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
🇪🇸
el-brujo
2026-10-11 12:51:20
(1 day ago)
Cloudflare WAF: Request Path: /.env.development::$DATA Request Query: ?raw Host: status.elhacker.net ...
show more
Cloudflare WAF: Request Path: /.env.development::$DATA Request Query: ?raw Host: status.elhacker.net userAgent: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html) Action: block Source: firewallCustom ASN Description: Google LLC Country: DE Method: GET Timestamp: 2026-10-11T12:51:20Z ruleId: 6b2d48d0415e4adb9f099d85f54d1de6. Report generated by Cloudflare-WAF-to-AbuseIPDB.
show less
Hacking
SQL Injection
Web App Attack
🇩🇪
updown.io
2026-10-11 12:50:10
(1 day ago)
{"level":"info","ts":1791723008.5291305,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791723008.5291305,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.141.48.166","remote_port":"60986","client_ip":"34.141.48.166","proto":"HTTP/2.0","method":"POST","host":"status.anw.net","uri":"/graphql","headers":{"Origin":["https://status.anw.net"],"Sec-Fetch-Mode":["cors"],"Sec-Fetch-Site":["same-origin"],"Sec-Fetch-Dest":["empty"],"Referer":["https://status.anw.net"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Priority":["u=1, i"],"Sec-Ch-Ua-Mobile":["?0"],"Accept":["*/*"],"Accept-Language":["en-US,en;q=0.9"],"Content-Length":["86"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Content-Type":["application/json"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.anw.net","ech":fa
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 09:59:28
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.141.48.166 (166.48.141.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.141.48.166 (166.48.141.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 05:59:23.133379 2026] [security2:error] [pid 29166:tid 29166] [client 34.141.48.166:41764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "railfanfromseo.powerlinemultimedia.net"] [uri "/.htpasswd"] [unique_id "astd-6o6wr9KRCRNdGp43QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2026-10-11 09:53:57
(1 day ago)
11/Oct/2026:11:53:57.295686 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
11/Oct/2026:11:53:57.295686 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.141.48.166] ModSecurity: Warning. Pattern match "\\\\\\\\.\\\\\\\\./" at REQUEST_URI. [file "/etc/httpd/conf.d/mod_security.conf"] [line "127"] [id "500002"] [hostname "quads.ddns.net"] [uri "/userfiles/x"] [unique_id "astctaZvdFNDM67vsNr3zwADLlI"]
...
show less
Hacking
Web App Attack
🇩🇪
jakidomi
2026-10-11 09:23:04
(1 day ago)
CrowdSec detection: crowdsecurity/http-sensitive-files
Web App Attack
🇺🇸
magnetosphere-tarpit
2026-10-11 08:46:39
(1 day ago)
Automated web scanner: repeatedly probed for .env, .git, wp-admin and PHP webshell paths that do not ...
show more
Automated web scanner: repeatedly probed for .env, .git, wp-admin and PHP webshell paths that do not exist on this host. Tarpitted, then banned: 10 requests within 24h0m0s
show less
Port Scan
Bad Web Bot
Web App Attack
2026-10-11 08:45:31
(1 day ago)
34.141.48.166 - - [11/Oct/2026:10:45:30 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ H ...
show more
34.141.48.166 - - [11/Oct/2026:10:45:30 +0200] "GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ HTTP/1.1" 400 150 "-" "-"
34.141.48.166 - - [11/Oct/2026:10:45:30 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 150 "-" "-"
34.141.48.166 - - [11/Oct/2026:10:45:30 +0200] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 150 "-" "-"
34.141.48.166 - - [11/Oct/2026:10:45:30 +0200] "GET /appearance/../../.env HTTP/1.1" 400 150 "-" "-"
...
show less
Web App Attack
🇺🇸
mawan
2026-10-11 08:31:45
(1 day ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇩🇪
raph
2026-10-11 08:29:19
(1 day ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-11 06:28:07
(2 days ago)
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ...
show more
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.141.48.166 - - [11/Oct/2026:08:27:47 +0200] "GET /account HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.141.48.166 - - [11/Oct/2026:08:27:47 +0200] "GET /forgot-password HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.141.48.166 - - [11/Oct/2026:08:27:47 +0200] "GET /console HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.141.48.166 - - [11/Oct/2026:08:27:47 +0200] "GET /dashboard HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML
...
show less
Bad Web Bot
Web App Attack
🇩🇪
Skyrider
2026-10-11 05:44:53
(2 days ago)
Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.
Bad Web Bot
Web App Attack
🇬🇧
stevendodd
2026-10-11 05:44:51
(2 days ago)
34.141.48.166 - - [11/Oct/2026:06:44:50 +0100] "GET /.aws/credentials HTTP/1.1" 404 262 "-" "Mozilla ...
show more
34.141.48.166 - - [11/Oct/2026:06:44:50 +0100] "GET /.aws/credentials HTTP/1.1" 404 262 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
34.141.48.166 - - [11/Oct/2026:06:44:50 +0100] "GET /.git/config HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
34.141.48.166 - - [11/Oct/2026:06:44:50 +0100] "GET /build/.env HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.141.48.166 - - [11/Oct/2026:06:44:50 +0100] "GET /dist/.env HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.141.48.166 - - [11/Oct/2026:06:44:50 +0100] "GET /.aws/config HTTP/1.1" 404 4327 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
34.141.48.166 - - [11/Oct/2026:06:44:50 +0100] "GET /web/.env HTTP/1.1" 404 262 "-" "Mozilla/5.0 (compatible; cohere-a
...
show less
Brute-Force
Web App Attack
