๐ฉ๐ช
andorin
2026-10-02 01:10:02
(2 days ago)
Automated report from halo.habith.eu (NGINX access log).
Detected 115 suspicious requests in last 2 ...
show more
Automated report from halo.habith.eu (NGINX access log).
Detected 115 suspicious requests in last 20000 lines.
Sample log lines:
34.146.8.237 - - [01/Oct/2026:08:28:23 +0200] "GET /static../.env HTTP/1.1" 403 134 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"\n34.146.8.237 - - [01/Oct/2026:08:28:23 +0200] "GET /js../.env HTTP/1.1" 403 134 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"\n34.146.8.237 - - [01/Oct/2026:08:28:24 +0200] "GET /css../.env HTTP/1.1" 403 134 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4\n34.146.8.237 - - [01/Oct/2026:08:28:24 +0200] "GET /build../.env HTTP/1.1" 403 134 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"\n34.146.8.237 - - [01/Oct/2026:08:28:24 +0200] "GET /..%2f.env HTTP/1.1" 400 166 "-" "-"\n34.146.8.237 - - [01/Oct/2026:08:28:24 +0200] "GET //.env HTTP/1.1" 403 134 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
show less
DDoS Attack
Ping of Death
Hacking
๐ซ๐ท
IRISIO
2026-10-01 08:26:35
(3 days ago)
scans/SQL injection/spam posts : 30057 queries
Web App Attack
SQL Injection
Anonymous
2026-10-01 07:32:28
(3 days ago)
34.146.8.237 - - [01/Oct/2026:09:32:28 +0200] "GET / HTTP/1.1" 403 5776 "-" "Mozilla/5.0 (Windows NT ...
show more
34.146.8.237 - - [01/Oct/2026:09:32:28 +0200] "GET / HTTP/1.1" 403 5776 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" ...
show less
Web App Attack
๐ฉ๐ช
ger-stg-sifi1
2026-10-01 07:27:45
(3 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
๐ซ๐ท
ELYAZ
2026-10-01 05:53:50
(3 days ago)
(y3) Failed access -byebye- from 34.146.8.237 (JP/Japan/237.8.146.34.bc.googleusercontent.com): (CF ...
show more
(y3) Failed access -byebye- from 34.146.8.237 (JP/Japan/237.8.146.34.bc.googleusercontent.com): (CF_ENABLE)
show less
Hacking
Anonymous
2026-10-01 05:26:43
(3 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
๐ช๐ธ
el-brujo
2026-10-01 05:11:12
(3 days ago)
01/Oct/2026:07:11:11.280084 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
01/Oct/2026:07:11:11.280084 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.146.8.237] ModSecurity: Warning. Pattern match "(?:;|\\\\\\\\{|\\\\\\\\||\\\\\\\\|\\\\\\\\||&|&&|\\\\\\\\n|\\\\\\\\r|\\\\\\\\$\\\\\\\\(|\\\\\\\\$\\\\\\\\(\\\\\\\\(|`|\\\\\\\\${|<\\\\\\\\(|>\\\\\\\\(|\\\\\\\\(\\\\\\\\s*\\\\\\\\))\\\\\\\\s*(?:{|\\\\\\\\s*\\\\\\\\(\\\\\\\\s*|\\\\\\\\w+=(?:[^\\\\\\\\s]*|\\\\\\\\$.*|\\\\\\\\$.*|<.*|>.*|\\\\\\\\'.*\\\\\\\\'|\\\\".*\\\\")\\\\\\\\s+|!\\\\\\\\s*|\\\\\\\\$)*\\\\\\\\s*(?:'|\\\\")*(?:[\\\\\\\\?\\\\\\\\*\\\\\\\\[\\\\\\\\]\\\\\\\\(\\\\\\\\)\\\\\\\\-\\\\\\\\|+\\\\\\\\w'\\\\"\\\\\\\\./\\\\\\\\\\\\\\\\]+/)?[\\\\\\\\\\\\\\\\'\\\\"]*(?:s[\\\\\\\\\\\\\\\\'\\\\"]* ..." at ARGS_NAMES:<?php echo shell_exec('env 2>/dev/null || set 2>nul'); die(); ?>. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "159"] [id "932105"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: || set 2>nul');
...
show less
Hacking
Web App Attack
๐ซ๐ท
regishoussin
2026-10-01 05:09:29
(3 days ago)
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of ...
show more
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-01 05:09 UTC.
show less
Bad Web Bot
Web App Attack
๐ณ๐ฑ
Alt255
2026-10-01 05:03:58
(3 days ago)
[cb-04al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail ngin ...
show more
[cb-04al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 34.146.8.237 - - [01/Oct/2026:07:03:54 +0200] "GET /z9x8c7v6b5-debug-trigger-hottea.eu HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
34.146.8.237 - - [01/Oct/2026:07:03:54 +0200] "GET /signin HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
34.146.8.237 - - [01/Oct/2026:07:03:54 +0200] "GET /account/login HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
34.146.8.237 - - [01/Oct/2026:07:03:54 +0200] "GET /sign-in HTTP/1.0" 404 3595 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537
...
show less
Bad Web Bot
Web App Attack
๐ณ๐ฑ
DSCloud9
2026-10-01 04:40:48
(3 days ago)
Rce attack (14 attempts) targeting dscloud9.eu - Severity: high
Hacking
Web App Attack
๐ซ๐ฎ
habs
2026-10-01 03:17:18
(3 days ago)
34.146.8.237 - - [01/Oct/2026:06:17:17 +0300] "GET /console HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Window ...
show more
34.146.8.237 - - [01/Oct/2026:06:17:17 +0300] "GET /console HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
...
show less
Web App Attack
๐ฉ๐ช
netclix.gr
2026-10-01 03:05:07
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 34.146.8.237 (JP/Japan/237.8.146.34.bc. ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.146.8.237 (JP/Japan/237.8.146.34.bc.googleusercontent.com): (CF_ENABLE)
show less
SQL Injection
๐ฉ๐ช
SiyCah
2026-10-01 03:00:03
(3 days ago)
IP banned by fail2ban; banned in jail apache-modsecurity. Report generated by fail2abuseipdb.
Hacking
Brute-Force
Web App Attack
๐ฉ๐ช
et-a_network
2026-10-01 02:28:20
(3 days ago)
34.146.8.237 - - [01/Oct/2026:02:28:18 +0000] "GET /api/console/api_server?sense_version=%40%40SENSE ...
show more
34.146.8.237 - - [01/Oct/2026:02:28:18 +0000] "GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env HTTP/2.0" 404 1925 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )" host=cloud.et-a.eu via=162.158.103.130 rt=0.077
34.146.8.237 - - [01/Oct/2026:02:28:18 +0000] "GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ HTTP/2.0" 404 1928 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)" host=cloud.et-a.eu via=172.64.200.125 rt=0.059
...
show less
Bad Web Bot
Web App Attack
๐ซ๐ท
Jimbo67
2026-10-01 02:08:48
(3 days ago)
Cloudflare WAF: 14 hits in 30s | action=block | abuse=suspicious_probe | categories=19,21 | rule_id= ...
show more
Cloudflare WAF: 14 hits in 30s | action=block | abuse=suspicious_probe | categories=19,21 | rule_id=0189a8c2c2ab4a60bc709bad14577d18 | URIs=/.env.development??raw,/.env.php.bak,/@fs/.env??raw&url??,/@fs/app/.env.production??import&raw??,/@fs/app/.env??import&raw?? | confidence=0.87
show less
Bad Web Bot
Web App Attack