Anonymous
2026-10-17 16:36:24
(1 day ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
π§π·
Caue Henrique
2026-10-16 03:00:01
(3 days ago)
Multiple common web attacks, XSS, Web Server 500 Error
Web Spam
Hacking
Web App Attack
π§π·
dermatovirtual
2026-10-12 01:48:34
(1 week ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 108 unauthorized requests recorded between 2026-10-11 01:43:55 UTC and 2026-10-11 01:44:05 UTC (rate: ~108 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-10-11 01:44:05 UTC] IP: 34.156.135.247 - W3C IIS (Port 443): GET /static/app/.env -> HTTP 404 [CLIENT: 34.156.135.247]
[2026-10-11 01:44:05 UTC] IP: 34.156.135.247 - W3C IIS (Port 443): GET /dashboard/.env -> HTTP 404 [CLIENT: 34.156.135.247]
[2026-10-11 01:44:05 UTC] IP: 34.156.135.247 - W3C IIS (Port 443): GET /admin/.env -> HTTP 404 [CLIENT: 34.156.135.247]
show less
Bad Web Bot
Web App Attack
Anonymous
2026-10-11 16:35:38
(1 week ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
πΊπΈ
mibbsdevs
2026-10-11 09:28:36
(1 week ago)
(ric-sv) CoffeePot Web: Automated bad bot directory fuzzing and high-rate 404 probing.
Port Scan
Bad Web Bot
π«π·
mrcrassi
2026-10-11 05:42:28
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from BE.
Action taken: BLOCK
Protocol: HTTP/2 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from BE.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /.gitlab-ci.yml
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
π§π·
Sysadmin-CLC
2026-10-11 05:09:49
(1 week ago)
Probing and trying to access sensitive files caught in f2b nginx-forbidden filter
Web App Attack
Port Scan
Anonymous
2026-10-11 03:32:07
(1 week ago)
34.156.135.247 - - [11/Oct/2026:00:32:06 -0300] "GET /.git/config HTTP/2.0" 403 862 "-" "Mozilla/5.0 ...
show more
34.156.135.247 - - [11/Oct/2026:00:32:06 -0300] "GET /.git/config HTTP/2.0" 403 862 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
...
show less
Port Scan
Hacking
SQL Injection
Brute-Force
Bad Web Bot
Exploited Host
π§π·
dominioz
2026-10-11 02:52:28
(1 week ago)
[2026-10-10 23:47:32] [UA-ROTATION] 34.156.135.247 - 4 User-Agents distintos (IIS)
[2026-10-10 23:51 ...
show more
[2026-10-10 23:47:32] [UA-ROTATION] 34.156.135.247 - 4 User-Agents distintos (IIS)
[2026-10-10 23:51:53] [UA-ROTATION] 34.156.135.247 - 4 User-Agents distintos (IIS)
[2026-10-10 23:51:57] [UA-ROTATION] 34.156.135.247 - 4 User-Agents distintos (IIS)
[2026-10-10 23:52:02] [UA-ROTATION] 34.156.135.247 - 4 User-Agents distintos (IIS)
[2026-10-10 23:52:27] [UA-ROTATION] 34.156.135.247 - 4 User-Agents distintos (IIS)
...
show less
DDoS Attack
Web Spam
Blog Spam
Port Scan
Brute-Force
Exploited Host
Web App Attack
π§π·
Sysadmin-CLC
2026-10-11 02:28:05
(1 week ago)
Caught by f2b nginx-limit-req.
Web App Attack
DDoS Attack
π§π·
dermatovirtual
2026-10-11 01:46:51
(1 week ago)
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ...
show more
Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 108 unauthorized requests recorded between 2026-10-11 01:43:55 UTC and 2026-10-11 01:44:05 UTC (rate: ~108 req/min). Edge perimeter firewall drop active.
Log sample:
[2026-10-11 01:44:05 UTC] IP: 34.156.135.247 - W3C IIS (Port 443): GET /static/app/.env -> HTTP 404 [CLIENT: 34.156.135.247]
[2026-10-11 01:44:05 UTC] IP: 34.156.135.247 - W3C IIS (Port 443): GET /dashboard/.env -> HTTP 404 [CLIENT: 34.156.135.247]
[2026-10-11 01:44:05 UTC] IP: 34.156.135.247 - W3C IIS (Port 443): GET /admin/.env -> HTTP 404 [CLIENT: 34.156.135.247]
show less
Bad Web Bot
Web App Attack
π¨π¦
cubie
2026-10-11 00:53:49
(1 week ago)
Port Scan: Admin Enumeration - Reported by CubieCloud Firewall [CFW_H459-004]
Port Scan
π©πͺ
niedson
2026-10-11 00:30:01
(1 week ago)
Automated scanning for exposed secrets: repeated requests for multiple distinct credential paths (.e ...
show more
Automated scanning for exposed secrets: repeated requests for multiple distinct credential paths (.env variants, .git metadata, .ssh private keys, .aws/credentials). Unsolicited. Reported automatically.
show less
Web App Attack
π¬π§
consul.to
2026-10-10 22:49:33
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
πͺπΈ
pipeline.es
2026-10-10 21:56:51
(1 week ago)
Web scanning / probing for vulnerable paths | URL: /.env.save | Evidence: ramatur.com.br 34.156.135. ...
show more
Web scanning / probing for vulnerable paths | URL: /.env.save | Evidence: ramatur.com.br 34.156.135.247 - - [10/Oct/2026:23:55:47 +0200] \"GET /.env.save HTTP/2.0\" 403 199 \"-\" \"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)\" GEOIP_COUNTRY_CODE=BE 2581 | ASN: GOOGLE-CLOUD-PLATFORM | Country: US
show less
Port Scan
Web App Attack