🇳🇱
Site.eu
2026-10-12 11:41:39
(2 days ago)
Excessive multi-domain requests
Brute-Force
🇧🇷
Peregrine
2026-10-11 03:16:00
(3 days ago)
Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 34.39.246.207 172.69.138.94 - - [08/Oct/2026:16:29: ...
show more
Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 34.39.246.207 172.69.138.94 - - [08/Oct/2026:16:29:28 -0300] "GET /.ssh/id_rsa HTTP/1.1" 404 18149
show less
Bad Web Bot
🇧🇷
Peregrine
2026-10-10 03:15:43
(4 days ago)
Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 34.39.246.207 172.69.138.94 - - [08/Oct/2026:16:29: ...
show more
Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 34.39.246.207 172.69.138.94 - - [08/Oct/2026:16:29:28 -0300] "GET /.ssh/id_rsa HTTP/1.1" 404 18149
show less
Bad Web Bot
🇭🇺
DumaNet
2026-10-09 08:41:00
(5 days ago)
Web app attack attempts, scanning for vulnerability.
Date: 2026 Oct 08. 20:51:48
Source IP: 34.39. ...
show more
Web app attack attempts, scanning for vulnerability.
Date: 2026 Oct 08. 20:51:48
Source IP: 34.39.246.207
Portion of the log(s):
34.39.246.207 - [08/Oct/2026:20:51:48 +0200] "GET /js../.env HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
34.39.246.207 - [08/Oct/2026:20:51:48 +0200] "GET //.env HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
34.39.246.207 - [08/Oct/2026:20:51:48 +0200] "GET /css../.env HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
34.39.246.207 - [08/Oct/2026:20:51:48 +0200] "GET /build../.env HTTP/1.1" 404 153 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
34.39.246.207 - [08/Oct/2026:20:51:48 +0200] "GET /z9x8c7v6b5-debug-trigger-deathlegion.org HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
34.39.246.207 - [08/Oct/2026:20:51:47 +0200] "POST /lib/terminal-xhr.php HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0
show less
Web App Attack
2026-10-09 05:39:16
(5 days ago)
/static//app/.env
Web App Attack
🇬🇧
openstrike.co.uk
2026-10-09 05:15:22
(5 days ago)
74 attacks on password/key grabbing URLs, env grabbing URLs (type 2), shell probes, env grabbing URL ...
show more
74 attacks on password/key grabbing URLs, env grabbing URLs (type 2), shell probes, env grabbing URLs, config grabbing URLs (type 2), PHP URLs:
GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=rsc HTTP/1.1
GET /api/system/fileView?file=/proc/self/environ HTTP/1.1
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
GET /cache/original/%2e%2e/.env HTTP/1.1
GET /app-config.json HTTP/1.1
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1
show less
Hacking
Web App Attack
🇧🇪
taivas.nl
2026-10-09 04:32:53
(5 days ago)
Many_bad_calls
Web App Attack
2026-10-09 04:29:38
(5 days ago)
Aggressive web scan
Web App Attack
2026-10-09 04:18:07
(5 days ago)
Web scanner: GET /uploads../.env
Web App Attack
Hacking
2026-10-09 04:07:33
(5 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇺🇸
deskpass.com
2026-10-09 04:07:14
(5 days ago)
GET /document.php
Web App Attack
🇧🇷
Peregrine
2026-10-09 03:12:19
(5 days ago)
Fail2Ban ct101 Jail: tomcat-404 | Evidence: 34.39.246.207 172.69.138.190 - - [08/Oct/2026:16:29:28 - ...
show more
Fail2Ban ct101 Jail: tomcat-404 | Evidence: 34.39.246.207 172.69.138.190 - - [08/Oct/2026:16:29:28 -0300] "GET /z9x8c7v6b5-debug-trigger-decise.com.br HTTP/1.1" 404 18149
34.39.246.207 172.69.138.190 - - [08/Oct/2026:16:29:28 -0300] "GET /build/manifest.json HTTP/1.1" 404 18149
34.39.246.207 172.69.138.190 - - [08/Oct/2026:16:29:28 -0300] "GET /dist/manifest.json HTTP/1.1" 404 18149
34.39.246.207 172.69.138.190 - - [08/Oct/2026:16:29:28 -0300] "GET /.vite/manifest.json HTTP/1.1" 404 18149
34.39.246.207 172.69.138.190 - - [08/Oct/2026:16:29:28 -0300] "GET /e7r111qacakgig59xqzx HTTP/1.1" 404 18149
show less
Bad Web Bot
Web App Attack
🇺🇸
factor1
2026-10-09 02:28:03
(5 days ago)
CrowdSec at atlas Reports Abuse
Web App Attack
🇳🇱
Savvii
2026-10-09 02:14:59
(5 days ago)
20 attempts against mh-misbehave-ban on lunar
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 01:32:55
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.39.246.207 (207.246.39.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.39.246.207 (207.246.39.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:32:52.396864 2026] [security2:error] [pid 31334:tid 31334] [client 34.39.246.207:46244] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tolenaar.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tolenaar.com"] [uri "/z9x8c7v6b5-debug-trigger-tolenaar.com"] [unique_id "ashEREsPEzmITw1KRlwgUAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
