|
🇳🇱
oisecnet
|
|
Automated report: Unauthorized vulnerability scanning detected on 2026-09-30. 212 requests from this IP.
|
Port Scan
Hacking
Web App Attack
|
|
Anonymous
|
|
Blocked by ModSec and CSF
|
Port Scan
|
|
🇩🇪
LRob
|
|
Wordlist path sweep | method: POST, GET | path: /lib/terminal-xhr.php, /model/info, /dve3mm9gf98o669c1alo (+3 more) | ua: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html), Mozilla/5.0 (compatible; cohere-ai; +https: ...
show more
Wordlist path sweep | method: POST, GET | path: /lib/terminal-xhr.php, /model/info, /dve3mm9gf98o669c1alo (+3 more) | ua: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html), Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler), Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) (+2 more)
show less
|
Port Scan
Web App Attack
|
|
Anonymous
|
|
| Multiple common web attacks from same source ip. (multiple servers)
|
Web App Attack
Hacking
SQL Injection
|
|
🇵🇱
sefinek.net
|
|
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /cgi-bin/php-cgi.exe | UA: Mozilla/5.0 (compatible; Bytespider; [email protected]) AppleWebKit/537.36 • Generated by: github.com/sefinek ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /cgi-bin/php-cgi.exe | UA: Mozilla/5.0 (compatible; Bytespider; [email protected]) AppleWebKit/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
|
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 12:27:54.890571 2026] [security2:error] [pid 21863:tid 21 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 12:27:54.890571 2026] [security2:error] [pid 21863:tid 21873] [client 34.159.18.76:46206] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ouye.net|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ouye.net"] [uri "/elmah.axd"] [unique_id "ar04itQVrQZWJospZIXoowAAAEM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
todix
|
|
WebAttack or semilar from 34.159.18.76
|
Web App Attack
|
|
🇫🇮
pixiekat
|
|
Banned by fail2ban (apache-modsecurity, 3 hits) [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"]
|
Web App Attack
|
|
🇺🇸
Charlesiv
|
|
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (POST method)
Endpoint: /read-document
Timestamp: 2026-09-30T14:53:20Z
Ray ID: a4340e7b6b5bd299
UA: Mozilla/5.0 (compatible; MoonshotBot/ ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (POST method)
Endpoint: /read-document
Timestamp: 2026-09-30T14:53:20Z
Ray ID: a4340e7b6b5bd299
UA: Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)
show less
|
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 11:49:10.011537 2026] [security2:error] [pid 23615:tid 23 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 11:49:10.011537 2026] [security2:error] [pid 23615:tid 23615] [client 34.159.18.76:41570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.computerian.net"] [uri "/wp-config.php.bak"] [unique_id "ar0vdqIqciOSLQNdDJ0SigAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 11:11:31.137413 2026] [security2:error] [pid 11506:tid 11 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 11:11:31.137413 2026] [security2:error] [pid 11506:tid 11506] [client 34.159.18.76:52604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.houseofbates.net"] [uri "/.htpasswd"] [unique_id "ar0mo16PpVGig_QH3aMnZgAAAAU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇳🇱
Alt255
|
|
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.159.18.76 - - [30/Sep/2026:17:05:49 +0200] "GET /secure HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb ...
show more
[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 34.159.18.76 - - [30/Sep/2026:17:05:49 +0200] "GET /secure HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.159.18.76 - - [30/Sep/2026:17:05:49 +0200] "GET /vjpa0guy6fmblx8ccjr1 HTTP/2.0" 404 1855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])"
34.159.18.76 - - [30/Sep/2026:17:05:49 +0200] "GET /auth/login HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.159.18.76 - - [30/Sep/2026:17:05:49 +0200] "GET /signin HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 10:15:33.982639 2026] [security2:error] [pid 15538:tid 15 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.18.76 (76.18.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 10:15:33.982639 2026] [security2:error] [pid 15538:tid 15538] [client 34.159.18.76:57926] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "theprideproject.net"] [uri "/.htpasswd"] [unique_id "ar0ZhX1i4L19GE0hLLRKDQAAAA0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
Hagen Schoebel
|
|
Blocked by CrowdSec - crowdsecurity/http-sensitive-files (DE)
|
Port Scan
Brute-Force
Web App Attack
SSH
|
|
🇬🇧
bensmithurst
|
|
34.159.18.76 - - [30/Sep/2026:14:05:36 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/1.1" 400 150 "-" "-"
34.159.18.76 - - [30/Sep/2026:14:05:36 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 4 ...
show more
34.159.18.76 - - [30/Sep/2026:14:05:36 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/1.1" 400 150 "-" "-"
34.159.18.76 - - [30/Sep/2026:14:05:36 +0000] "GET /static/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 150 "-" "-"
34.159.18.76 - - [30/Sep/2026:14:05:36 +0000] "GET /resources/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/1.1" 400 150 "-" "-"
34.159.18.76 - - [30/Sep/2026:14:05:37 +0000] "GET /..%2f.env HTTP/1.1" 400 150 "-" "-"
34.159.18.76 - - [30/Sep/2026:14:05:37 +0000] "GET /%2e%2e/.env HTTP/1.1" 400 150 "-" "-"
... [host=LAN***]
show less
|
Web App Attack
|
