|
🇩🇪
ghostwarriors
|
|
Attempts against non-existent wp-login
|
Brute-Force
Web App Attack
|
|
Anonymous
|
|
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-crawl-non_statics; Action=ban; Events=43; Hosts=incognet.io; Paths=/.env.local,/.env.old,/.env.prod,/.env.save,/gcp-service.json,/google-services.json; Country=NL; ASN=396982 GOOGLE-CL ...
show more
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-crawl-non_statics; Action=ban; Events=43; Hosts=incognet.io; Paths=/.env.local,/.env.old,/.env.prod,/.env.save,/gcp-service.json,/google-services.json; Country=NL; ASN=396982 GOOGLE-CLOUD-PLATFORM
show less
|
Bad Web Bot
|
|
🇩🇪
LRob
|
|
Vulnerability scanning | method: GET, POST | path: /assets/manifest.json, /7kkgf3oxcn3uluy6p632, /dist/manifest.json (+17 more) | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/ ...
show more
Vulnerability scanning | method: GET, POST | path: /assets/manifest.json, /7kkgf3oxcn3uluy6p632, /dist/manifest.json (+17 more) | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0, Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/), Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot (+5 more)
show less
|
Port Scan
Web App Attack
|
|
🇬🇧
thetomtaylor.co.uk
|
|
Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [ice01,ice02]
|
Hacking
SQL Injection
Web App Attack
|
|
Anonymous
|
|
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-path-traversal-probing; Action=ban; Events=4; Hosts=incognet.io; Paths=/@fs/../.env?import&raw??,/@fs/../.env?raw??,/@fs/proc/self/cmdline?raw??,/@fs/proc/self/cwd/.env?raw??; Country= ...
show more
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-path-traversal-probing; Action=ban; Events=4; Hosts=incognet.io; Paths=/@fs/../.env?import&raw??,/@fs/../.env?raw??,/@fs/proc/self/cmdline?raw??,/@fs/proc/self/cwd/.env?raw??; Country=NL; ASN=396982 GOOGLE-CLOUD-PLATFORM
show less
|
Port Scan
Web App Attack
|
|
🇩🇪
33three
|
|
Fail2Ban jail WebAttack triggered
|
Brute-Force
|
|
Anonymous
|
|
IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-cve-2021-41773; Action=ban; Events=1; Hosts=incognet.io; Paths=/cache/original/%2e%2e/%2e%2e/.env; Country=NL; ASN=396982 GOOGLE-CLOUD-PLATFORM
|
Hacking
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.187.50.143 (143.50.187.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 12:58:47.290059 2026] [security2:error] [pid 32528:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.187.50.143 (143.50.187.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 12:58:47.290059 2026] [security2:error] [pid 32528:tid 32528] [client 34.187.50.143:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mindmaterial.io"] [uri "/core/.env"] [unique_id "askdR6Yu6gox-QFyUgEA2AAAAAk"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
34.187.50.143 - - [09/Oct/2026:18:54:17 +0200] "GET /.htpasswd HTTP/2.0" 403 272 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
|
Web Spam
Blog Spam
Brute-Force
Web App Attack
|
|
Anonymous
|
|
IP matched detection query 20 more in short time bad rqs.
|
Brute-Force
Web App Attack
Hacking
|
|
🇩🇪
ghostwarriors
|
|
Webpage scraping
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
Manuel Braeuer
|
|
34.187.50.143 - - [09/Oct/2026:18:37:09 +0200] "GET /.htpasswd HTTP/1.1" 403 6275 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.187.50.143 - - [09/Oct/2026:18:37:10 +0200] "GET /@fs/../.env?raw?? HTTP/1.1" 403 6275 "-" "Moz ...
show more
34.187.50.143 - - [09/Oct/2026:18:37:09 +0200] "GET /.htpasswd HTTP/1.1" 403 6275 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
34.187.50.143 - - [09/Oct/2026:18:37:10 +0200] "GET /@fs/../.env?raw?? HTTP/1.1" 403 6275 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
34.187.50.143 - - [09/Oct/2026:18:37:11 +0200] "GET /@fs/../.env?import&raw?? HTTP/1.1" 403 6275 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
34.187.50.143 - - [09/Oct/2026:18:37:11 +0200] "GET /.env?import&raw HTTP/1.1" 403 6275 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])"
34.187.50.143 - - [09/Oct/2026:18:37:11 +0200] "GET /.env?import&url&inline HTTP/1.1" 403 6275 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected]) AppleWebKit/537.36"
...
show less
|
Web App Attack
|
|
Anonymous
|
|
Banned by Fail2Ban on server
|
Web App Attack
|
|
🇫🇷
eric-lemesre
|
|
34.187.50.143 - - [09/Oct/2026:18:28:51 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:51 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:52 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:52 +0200] "- ...
show more
34.187.50.143 - - [09/Oct/2026:18:28:51 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:51 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:52 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:52 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:52 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:56 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:56 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:56 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:56 +0200] "-" 400 150 "-" "-"
34.187.50.143 - - [09/Oct/2026:18:28:56 +0200] "-" 400 150 "-" "-"
...
show less
|
Web App Attack
|
|
🇩🇪
ksol-hostmaster
|
|
2026/10/09 18:21:38 [error] 42003#781755: *2765115 limiting requests, excess: 0.991 by zone "crawler", client: 34.187.50.143, server: ksol.io, request: "GET /wp-json HTTP/2.0", host: "ksol.io"
...
|
Bad Web Bot
|