🇳🇦
jacqueskruger
2026-11-07 03:55:07
UTC ·
(6 hours ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-07T03:53:18Z. Evidence: repeated distinct requests matchin ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-11-07T03:53:18Z. Evidence: repeated distinct requests matching our high-confidence scanner rules.
show less
Bad Web Bot
🇳🇱
homeshowdomain.nl
2026-11-06 22:59:51
UTC ·
(11 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-05.
Web App Attack
SSH
Hacking
🇸🇪
vaia.cloud
2026-11-06 10:45:02
UTC ·
(1 day ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇬🇧
consul.to
2026-11-06 10:09:58
UTC ·
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇭🇺
miszterx.hu
2026-11-06 07:15:12
UTC ·
(1 day ago)
XORP (haproxy): 270x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu)
Web App Attack
🇩🇪
ghostwarriors
2026-11-05 21:50:12
UTC ·
(1 day ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-05 21:24:36
UTC ·
(1 day ago)
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: - | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 S ...
show more
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: - | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3
Requested, e.g.:
- jira.[REDACTED]/
show less
Bad Web Bot
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-11-05 15:07:12
UTC ·
(1 day ago)
[Thu Nov 05 08:07:10.127258 2026] [authz_core:error] [pid 226436:tid 140078563169856] [client 34.176.99.177:37386] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Thu Nov 05 08:07:12.184576 2026] [authz_core:error] [pid 22643 ...
show more
[Thu Nov 05 08:07:10.127258 2026] [authz_core:error] [pid 226436:tid 140078563169856] [client 34.176.99.177:37386] AH01630: client denied by server configuration: /var/www/horde/.env.bak
[Thu Nov 05 08:07:12.184576 2026] [authz_core:error] [pid 226436:tid 140079737591360] [client 34.176.99.177:37386] AH01630: client denied by server configuration: /var/www/horde/.env.dist
[Thu Nov 05 08:07:12.316741 2026] [authz_core:error] [pid 226436:tid 140080372880960] [client 34.176.99.177:37386] AH01630: client denied by server configuration: /var/www/horde/.env.swp
...
show less
Bad Web Bot
🇨🇦
alexbfr
2026-11-05 11:31:59
UTC ·
(1 day ago)
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-11-05T11:31:59Z; reported_at=2026-11-05T11:32:01Z
2026-11-05T11:31:59Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-05T ...
show more
Fail2Ban report from nginx-bot-trap; service=HTTP; application_protocol=HTTP; observed_at=2026-11-05T11:31:59Z; reported_at=2026-11-05T11:32:01Z
2026-11-05T11:31:59Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
2026-11-05T11:31:59Z activity=bot-trap request method=GET nginx_status=444 probe_target=/.env
show less
Web App Attack
🇮🇹
VHosting
2026-11-05 11:00:05
UTC ·
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
Anonymous
2026-11-05 07:42:57
UTC ·
(2 days ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.176.99.177 (CL/Chile/177.99.176.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.176.99.177 - - [05/Nov/2026:08:42:55 +01 ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.176.99.177 (CL/Chile/177.99.176.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.176.99.177 - - [05/Nov/2026:08:42:55 +0100] "GET /.env HTTP/1.1" 406 518 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.176.99.177 - - [05/Nov/2026:08:42:56 +0100] "GET /.env.local HTTP/1.1" 406 4885 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.176.99.177 - - [05/Nov/2026:08:42:56 +0100] "GET /.env.production HTTP/1.1" 406 4885 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Port Scan
🇺🇸
abenage
2026-11-05 07:26:45
UTC ·
(2 days ago)
34.176.99.177 - - [05/Nov/2026:00:26:45 -0700] "GET /phpinfo.php HTTP/1.1" 404 564 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-05 06:07:25
UTC ·
(2 days ago)
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.176.99.177 - - [05/Nov/2026:07:07:09 +0100] "GET /.git/config HTTP/1.1" 404 1434 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebK ...
show more
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.176.99.177 - - [05/Nov/2026:07:07:09 +0100] "GET /.git/config HTTP/1.1" 404 1434 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
iNetWorker
2026-11-04 22:51:03
UTC ·
(2 days ago)
trolling for resource vulnerabilities
Web App Attack
🇩🇪
Hazzard
2026-11-04 21:11:34
UTC ·
(2 days ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection