2026-11-10 22:19:43
UTC ·
(6 hours ago)
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.18.190.249 (249.190.18.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.18.190.249 - - [10/Nov/2026:23:19:39 +0100] "GET ...
show more
(config_exploit_scan) Configuratie Scanner / Nep GPTBot 34.18.190.249 (249.190.18.34.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.18.190.249 - - [10/Nov/2026:23:19:39 +0100] "GET /.env HTTP/1.1" 406 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.190.249 - - [10/Nov/2026:23:19:40 +0100] "GET /.env HTTP/1.1" 406 518 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.190.249 - - [10/Nov/2026:23:19:40 +0100] "GET /.env.local HTTP/1.1" 406 4885 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
show less
Port Scan
🇦🇺
2000cn.com.au
2026-11-10 21:51:08
UTC ·
(6 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
ghostwarriors
2026-11-10 20:50:29
UTC ·
(7 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
throny
2026-11-10 20:46:49
UTC ·
(7 hours ago)
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safar ...
show more
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3
Requested, e.g.:
- ftp.[REDACTED]/
show less
Bad Web Bot
🇳🇱
WeCloudit-Anti-Abuse
2026-11-10 19:46:52
UTC ·
(8 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇩🇪
mondor.ro
2026-11-10 17:54:14
UTC ·
(10 hours ago)
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.18.190.249, Reason:[(mod_security) mod_security (id:210492) triggered by 34.18.190.249 (QA/Qatar/249.190.18.34.bc.googleusercontent.com): 3 in the last 3600 secs]; Ports ...
show more
Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 34.18.190.249, Reason:[(mod_security) mod_security (id:210492) triggered by 34.18.190.249 (QA/Qatar/249.190.18.34.bc.googleusercontent.com): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:
show less
Port Scan
2026-11-10 05:17:50
UTC ·
(23 hours ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇸🇪
nekopavel
2026-11-10 03:58:28
UTC ·
(1 day ago)
34.18.190.249 - - [10/Nov/2026:04:58:26 +0100]"GET /.git/config HTTP/1.1" 404 178"-" mail.pavel.gg "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""0.001" "0.000""Doha" "QA"
34.18.190.249 - - [10 ...
show more
34.18.190.249 - - [10/Nov/2026:04:58:26 +0100]"GET /.git/config HTTP/1.1" 404 178"-" mail.pavel.gg "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""0.001" "0.000""Doha" "QA"
34.18.190.249 - - [10/Nov/2026:04:58:27 +0100]"GET /.env HTTP/1.1" 404 178"-" mail.pavel.gg "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""0.000" "0.000""Doha" "QA"
34.18.190.249 - - [10/Nov/2026:04:58:27 +0100]"GET /.env.local HTTP/1.1" 404 178"-" mail.pavel.gg "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""0.000" "0.000""Doha" "QA"
...
show less
Hacking
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-11-10 03:36:15
UTC ·
(1 day ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇨🇦
swk
2026-11-09 12:42:21
UTC ·
(1 day ago)
34.18.190.249 - - [09/Nov/2026:20:42:19 +0800] "GET /.git/config HTTP/1.1" 404 479 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.190.249 - - [09/Nov/2026:20:42:20 +0800] "GET /.env H ...
show more
34.18.190.249 - - [09/Nov/2026:20:42:19 +0800] "GET /.git/config HTTP/1.1" 404 479 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.190.249 - - [09/Nov/2026:20:42:20 +0800] "GET /.env HTTP/1.1" 404 479 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.18.190.249 - - [09/Nov/2026:20:42:20 +0800] "GET /.env.local HTTP/1.1" 404 479 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
Brute-Force
🇦🇺
Klaverstyn
2026-11-09 12:27:36
UTC ·
(1 day ago)
Cross-vhost secrets/RCE probing campaign
Web App Attack
Hacking
🇩🇪
dbmwebdesign
2026-11-09 11:40:28
UTC ·
(1 day ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-08 22:59:13
UTC ·
(2 days ago)
Auto-ban: >3000 req/min op 2026-11-08
Web App Attack
SSH
Hacking
🇭🇷
IgorS.zg.hr
2026-11-08 22:00:44
UTC ·
(2 days ago)
Web application attack detected by fail2ban
Hacking
Web App Attack
🇳🇱
Savvii
2026-11-08 18:25:26
UTC ·
(2 days ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
