|
🇺🇸
Cyber Crusader
|
|
Hundreds of Attempts (at least) to Connect to and Access Firewall Ports
|
Port Scan
Hacking
Brute-Force
|
|
🇳🇱
homeshowdomain.nl
|
|
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-11.
|
Web App Attack
SSH
Hacking
|
|
Anonymous
|
|
(caddyscan) Scanner path probe from 34.18.103.93 (QA/Qatar/93.103.18.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.18.103.93 - - [12/Jun/2026:03:57:13 +0000] ...
show more
(caddyscan) Scanner path probe from 34.18.103.93 (QA/Qatar/93.103.18.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.18.103.93 - - [12/Jun/2026:03:57:13 +0000] "GET /v2/actuator/env HTTP/1.1"
[REDACTED] 200 2627 34.18.103.93 - - [12/Jun/2026:03:57:13 +0000] "GET /backend/actuator/configprops HTTP/1.1"
[REDACTED] 200 2627 34.18.103.93 - - [12/Jun/2026:03:57:13 +0000] "GET /actuator/sessions HTTP/1.1"
[REDACTED] 200 2627 34.18.103.93 - - [12/Jun/2026:03:57:13 +0000] "GET /.aws/config HTTP/1.1"
[REDACTED] 200 2627 34.18.103.93 - - [12/Jun/2026:03:57:13 +0000] "GET /v2/actuator/configprops HTTP/1.1"
show less
|
Port Scan
|
|
Anonymous
|
|
3782 hits, proto=tcp, ports=443,80
|
Port Scan
Hacking
|
|
🇩🇪
updown.io
|
|
{"level":"info","ts":1781225277.699483,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.18.103.93","remote_port":"42796","client_ip":"34.18.103.93","proto":"HTTP/1.1","method":"GET","host":"lkjihgfedcupdate.update.xw ...
show more
{"level":"info","ts":1781225277.699483,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.18.103.93","remote_port":"42796","client_ip":"34.18.103.93","proto":"HTTP/1.1","method":"GET","host":"lkjihgfedcupdate.update.xwvutsrqponmlknmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/actuator/env","headers":{"Accept-Encoding":["gzip"],"Connection":["close"],"User-Agent":["Mozilla/5.0 (X11; CrOS x86_64 11647.154.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.114 Safari/537.36"],"Accept-Charset":["utf-8"]}},"bytes_read":0,"user_id":"","duration":0.00008405,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://lkjihgfedcupdate.update.xwvutsrqponmlknmlkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/actuator/env"],"Content-Type":[]}}
{"level":"info","ts":1781225277.70337,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.18
...
show less
|
DDoS Attack
Web App Attack
|
|
🇩🇪
Philister11
|
|
CrowdSec: crowdsecurity/http-crawl-non_statics (QA/AS396982)
|
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
34.18.103.93 - - [11/Jun/2026:21:07:35 +0200] "GET /actuator/threaddump HTTP/1.1" 404 6851 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 YaBrowser/19.7.2.516 Yowser/2.5 Safari/537.36"
34.18.103.9 ...
show more
34.18.103.93 - - [11/Jun/2026:21:07:35 +0200] "GET /actuator/threaddump HTTP/1.1" 404 6851 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 YaBrowser/19.7.2.516 Yowser/2.5 Safari/537.36"
34.18.103.93 - - [11/Jun/2026:21:07:35 +0200] "GET /docker-compose.yaml HTTP/1.1" 404 6851 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15"
34.18.103.93 - - [11/Jun/2026:21:07:35 +0200] "GET /app/actuator/configprops HTTP/1.1" 404 6851 "-" "SuperBot/4.4.0.60 (Windows XP)"
34.18.103.93 - - [11/Jun/2026:21:07:35 +0200] "GET /actuator/threaddump HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 YaBrowser/19.7.2.516 Yowser/2.5 Safari/537.36"
34.18.103.93 - - [11/Jun/2026:21:07:35 +0200] "GET /docker-compose.yaml HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, l
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇩🇪
paissangroup
|
|
Multiple WAF Violations
|
Web App Attack
|
|
🇳🇱
Cloud86 B.V.
|
|
categories: DDoS Attack
|
DDoS Attack
|
|
🇬🇧
WebNiraj
|
|
(mod_security) mod_security (id:949110) triggered by 34.18.103.93 (QA/Qatar/93.103.18.34.bc.googleusercontent.com): 5 in the last 3600 secs [SIGMA]
|
Brute-Force
|
|
🇳🇱
Site.eu
|
|
Excessive multi-domain requests
|
Brute-Force
|
|
🇺🇸
jormaster3k
|
|
Attack against Apache (too many 404s)
|
Web App Attack
|
|
🇫🇷
masterguru
|
|
Restricted File Access Attempt. Matched phrase ".aws/" at REQUEST_FILENAME. (930130-201)
|
Hacking
Web App Attack
|
|
Anonymous
|
|
Auto-reported by Fail2Ban (NPM-Auth)
|
Web App Attack
|
|
🇧🇪
cmbplf
|
|
236 requests with url.path *credentials.json
|
Brute-Force
Bad Web Bot
|
