🇬🇧
oja
2026-09-22 11:17:18
(10 minutes ago)
Aggressive web scanner
Web App Attack
🇬🇧
seniorlinuxadmin
2026-09-22 10:53:38
(34 minutes ago)
34.19.24.62 - - [22/Sep/2026:11:53:35 +0100] "GET /login HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows ...
show more
34.19.24.62 - - [22/Sep/2026:11:53:35 +0100] "GET /login HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0"
show less
Port Scan
Web App Attack
🇪🇸
masterguru
2026-09-22 10:52:27
(35 minutes ago)
BAD BOT - Detected and Blocked.. Matched phrase "OAI-SearchBot" at REQUEST_HEADERS:user-agent. (1100 ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "OAI-SearchBot" at REQUEST_HEADERS:user-agent. (1100000-122)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-22 10:51:00
(37 minutes ago)
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 06:50:56.839110 2026] [security2:error] [pid 9889:tid 9889] [client 34.19.24.62:37400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pete-n-sheila.net"] [uri "/.env.staging"] [unique_id "arJdkLMURCgK2bQ5szsPHAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 10:03:46
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 06:03:38.864883 2026] [security2:error] [pid 15164:tid 15164] [client 34.19.24.62:41982] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "poltorak.net"] [uri "/.git/config"] [unique_id "arJSei7QFPTU3Zqjo0m6mwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-09-22 09:49:06
(1 hour ago)
(junkbot) REGOLA 8 - Junk Bot Blocked 34.19.24.62 (US/United States/62.24.19.34.bc.googleusercontent ...
show more
(junkbot) REGOLA 8 - Junk Bot Blocked 34.19.24.62 (US/United States/62.24.19.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.19.24.62 - - [22/Sep/2026:11:49:03 +0200] "GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/2.0" 200 12081 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" "-" host=qmcorporation.net
show less
Port Scan
🇺🇸
TPI-Abuse
2026-09-22 09:47:44
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 05:47:38.644846 2026] [security2:error] [pid 28562:tid 28562] [client 34.19.24.62:34216] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||quickasawink.net|F|2"] [data ".env.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "quickasawink.net"] [uri "/.env.backup"] [unique_id "arJOupEgiwe3F-VlHTn0mQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kadour
2026-09-22 09:42:46
(1 hour ago)
[Tue Sep 22 04:42:40.978707 2026] [proxy_fcgi:error] [pid 2838:tid 2942] [client 34.19.24.62:53210] ...
show more
[Tue Sep 22 04:42:40.978707 2026] [proxy_fcgi:error] [pid 2838:tid 2942] [client 34.19.24.62:53210] AH01071: Got error 'Primary script unknown', referer: https://ravenloft.net/index.php?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_get_contents&vars[1][]=.env
[Tue Sep 22 04:42:41.004297 2026] [proxy_fcgi:error] [pid 2848:tid 2981] [client 34.19.24.62:53244] AH01071: Got error 'Primary script unknown', referer: https://ravenloft.net/document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared
[Tue Sep 22 04:42:41.027129 2026] [proxy_fcgi:error] [pid 2848:tid 2980] [client 34.19.24.62:53208] AH01071: Got error 'Primary script unknown', referer: https://ravenloft.net/index.php?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=env
[Tue Sep 22 04:42:41.031709 2026] [proxy_fcgi:error] [pid 2848:tid 2987] [client 34.19.24.62:53188] AH01071: Got error 'Primary script unknown', referer: https://ravenloft.net/ind
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 09:30:58
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 05:30:55.562352 2026] [security2:error] [pid 17924:tid 17924] [client 34.19.24.62:56496] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robinsnestingplace.net"] [uri "/.env.bak"] [unique_id "arJKz-Bo4KQZh06i3pABwwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 09:13:43
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.19.24.62 (62.24.19.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 05:13:39.070480 2026] [security2:error] [pid 17028:tid 17028] [client 34.19.24.62:50800] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scotts.net"] [uri "/scripts/.env"] [unique_id "arJGw_nC2bg4Efre1KwBCQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
sc user
2026-09-22 09:13:18
(2 hours ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ...
show more
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
show less
Bad Web Bot
Web App Attack
Port Scan
🇵🇱
sefinek.net
2026-09-22 09:11:08
(2 hours ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /@fs/.env | UA: Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
Bedios GmbH
2026-09-22 09:07:16
(2 hours ago)
Wordpress hacking attempt
Web App Attack
🇩🇪
palzer.IT
2026-09-22 08:58:25
(2 hours ago)
Fail2ban automatic report for plesk-apache-badbot: 34.19.24.62 - - [22/Sep/2026:10:58:03 +0200] GET ...
show more
Fail2ban automatic report for plesk-apache-badbot: 34.19.24.62 - - [22/Sep/2026:10:58:03 +0200] GET /[DOMAIN_REMOVED] [DOMAIN_REMOVED] 404 6527 [DOMAIN_REMOVED] CCBot/2.0 ([DOMAIN_REMOVED]
show less
Bad Web Bot
🇳🇱
WeCloudit-Anti-Abuse
2026-09-22 08:57:13
(2 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
