๐ธ๐ฎ
administrator
2026-09-23 22:09:23
(18 hours ago)
2026-09-22 02:17:12,054 fail2ban.actions [1182]: NOTICE [media-server] Ban 34.22.106.46
2026 ...
show more
2026-09-22 02:17:12,054 fail2ban.actions [1182]: NOTICE [media-server] Ban 34.22.106.46
2026-09-22 02:17:12,054 fail2ban.actions [1182]: NOTICE [media-server] Ban 34.22.106.46
2026-09-22 02:17:12,054 fail2ban.actions [1182]: NOTICE [media-server] Ban 34.22.106.46
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-22 05:36:36
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 34.22.106.46 (46.106.22.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.22.106.46 (46.106.22.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 01:36:28.890525 2026] [security2:error] [pid 23238:tid 23238] [client 34.22.106.46:39382] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.qrsmusicrolls.com.player-care.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.qrsmusicrolls.com.player-care.com"] [uri "/.codex/auth.json.bak"] [unique_id "arIT3Kz6cDJrklVBQ-MKnwAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-21 22:45:57
(2 days ago)
crusader-worker bot detected by fail2ban
...
Bad Web Bot
Web App Attack
Anonymous
2026-09-21 18:46:06
(2 days ago)
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /.codex/config.json HTTP/1.1" 403 164 "-" "crusad ...
show more
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /.codex/config.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /app/.claude/credentials.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /.claude/.credentials.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /.claude/credentials.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /.claude/settings.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /www/.codex/auth.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /bak/.codex/auth.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200] "GET /backup/.codex/auth.json HTTP/1.1" 403 164 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:20:46:05 +0200]
...
show less
Bad Web Bot
Web App Attack
๐ฉ๐ช
ghostwarriors
2026-09-21 16:50:09
(3 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
๐ฉ๐ช
yitzhaq
2026-09-21 16:39:13
(3 days ago)
34.22.106.46 - - [21/Sep/2026:18:39:09 +0200] "GET /api/.codex/auth.json HTTP/1.1" 404 30698 "-" "cr ...
show more
34.22.106.46 - - [21/Sep/2026:18:39:09 +0200] "GET /api/.codex/auth.json HTTP/1.1" 404 30698 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:09 +0200] "GET /www/.codex/auth.json HTTP/1.1" 404 30699 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:09 +0200] "GET /web/.codex/auth.json HTTP/1.1" 404 30698 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:09 +0200] "GET /data/.codex/auth.json HTTP/1.1" 404 30700 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:10 +0200] "GET /wwwroot/.codex/auth.json HTTP/1.1" 404 26968 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:10 +0200] "GET /root/.codex/auth.json HTTP/1.1" 404 26968 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:10 +0200] "GET /srv/.codex/auth.json HTTP/1.1" 404 26968 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:10 +0200] "GET /files/.codex/auth.json HTTP/1.1" 404 26968 "-" "crusader-worker/1.0"
34.22.106.46 - - [21/Sep/2026:18:39:10 +
show less
Bad Web Bot
๐ฌ๐ง
gws-hostmaster
2026-09-21 13:34:41
(3 days ago)
ModSecurity OWASP CRS (Anomaly Score: 10): Restricted File Access Attempt;Restricted File Access Att ...
show more
ModSecurity OWASP CRS (Anomaly Score: 10): Restricted File Access Attempt;Restricted File Access Attempt: AI Coding Assistant Artifact;
show less
Web App Attack
๐ฌ๐ง
consul.to
2026-09-21 12:25:57
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
Anonymous
2026-09-21 12:11:27
(3 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
๐บ๐ธ
mnsf
2026-09-21 11:05:36
(3 days ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
๐ฆ๐น
vikal
2026-09-21 09:44:35
(3 days ago)
34.22.106.46 - - [21/Sep/2026:11:44:34 +0200] "GET /backup/.claude/credentials.json HTTP/1.1" 444 0 ...
show more
34.22.106.46 - - [21/Sep/2026:11:44:34 +0200] "GET /backup/.claude/credentials.json HTTP/1.1" 444 0 "-" "crusader-worker/1.0"
...
show less
Brute-Force
SSH
๐ฉ๐ช
Savvii
2026-09-21 07:14:13
(3 days ago)
20 attempts against mh_ha-misbehave-ban on sea
Brute-Force
Bad Web Bot
Web App Attack
๐ณ๐ฑ
WeCloudit-Anti-Abuse
2026-09-21 06:50:23
(3 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
๐ฉ๐ช
Sรฉfora Srl
2026-09-21 06:19:41
(3 days ago)
crowdsecurity/http-probing detected by CrowdSec
Web App Attack
๐ณ๐ฑ
Alt255
2026-09-21 05:48:09
(3 days ago)
[ti-01ov] Excessive 404 errors (web scanning): 30 suspicious requests detected by fail2ban jail <nam ...
show more
[ti-01ov] Excessive 404 errors (web scanning): 30 suspicious requests detected by fail2ban jail <name>. Example: 34.22.106.46 - - \[21/Sep/2026:07:47:52 +0200\] "GET /.claude/settings.local.json HTTP/1.1" 404 7478 "-" "crusader-worker/1.0"
34.22.106.46 - - \[21/Sep/2026:07:47:52 +0200\] "GET /.codex/config.json HTTP/1.1" 404 7478 "-" "crusader-worker/1.0"
34.22.106.46 - - \[21/Sep/2026:07:47:52 +0200\] "GET /tmp/.codex/auth.json HTTP/1.1" 404 7478 "-" "crusader-worker/1.0"
34.22.106.46 - - \[21/Sep/2026:07:47:52 +0200\] "GET /web/.codex/auth.json HTTP/1.1" 404 7478 "-" "crusader-worker/1.0"
34.22.106.46 - - \[21/Sep/2026:07:47:52 +0200\] "GET /old/.claude.json HTTP/1.1" 404 7478 "-" "crusader-worker/1.0"
34.22.106.46 - - \[21/Sep/2026:07:47:
...
show less
Bad Web Bot
Web App Attack