🇳🇱
Alt255
2026-10-28 05:49:40
(1 hour ago)
[cb-13al] Excessive 404 errors (web scanning): 31 suspicious requests detected by fail2ban jail apac ...
show more
[cb-13al] Excessive 404 errors (web scanning): 31 suspicious requests detected by fail2ban jail apache-404. Example: 34.6.13.227 - - [28/Oct/2026:06:49:33 +0100] "GET /__vite_rsc_findSourceMapURL?filename=file:///proc/self/environ&environmentName=rsc HTTP/2.0" 404 1856 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
34.6.13.227 - - [28/Oct/2026:06:49:33 +0100] "GET /.env.development?raw HTTP/2.0" 404 1856 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
34.6.13.227 - - [28/Oct/2026:06:49:33 +0100] "GET /@fs/proc/self/cmdline?raw?? HTTP/2.0" 404 1856 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
34.6.13.227 - - [28/Oct/2026:06:49:33 +0100] "GET /.env.local?raw HTTP/2.0" 404 1856 "-" "Mozilla/5.0 (compatible; Meta-WebInde
...
show less
Bad Web Bot
Web App Attack
2026-10-28 05:48:31
(1 hour ago)
Web application attack: grafana cve 2021 43798; Web application attack: http cve 2021 41773; Web app ...
show more
Web application attack: grafana cve 2021 43798; Web application attack: http cve 2021 41773; Web application attack: http path traversal probing; Probing for exposed secret / credential files; Web application attack: http sensitive files
show less
Hacking
Web App Attack
🇺🇸
interbiznw.com
2026-10-27 23:19:07
(7 hours ago)
fail2ban-ban
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 13:14:12
(17 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.6.13.227 (227.13.6.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.6.13.227 (227.13.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 09:14:08.442287 2026] [security2:error] [pid 3001:tid 3208] [client 34.6.13.227:46174] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.whitecrosslibrary.com|F|2"] [data ".whitecrosslibrary.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.whitecrosslibrary.com"] [uri "/z9x8c7v6b5-debug-trigger-mail.whitecrosslibrary.com"] [unique_id "auCjoMUkMoWSSQyoj-yUaAAAAcg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-27 12:37:14
(18 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
2026-10-27 11:34:00
(19 hours ago)
Excessive crawling/scraping. Vulnerable file probing.
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-27 10:39:14
(20 hours ago)
Web attack/malicious scanning detected
Web App Attack
2026-10-27 08:12:17
(22 hours ago)
34.6.13.227 - - [27/Oct/2026:03:12:15 -0500] "GET /.env.prod HTTP/1.1" 403 199 "-" "Mozilla/5.0 (com ...
show more
34.6.13.227 - - [27/Oct/2026:03:12:15 -0500] "GET /.env.prod HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" 34.6.13.227
34.6.13.227 - - [27/Oct/2026:03:12:15 -0500] "GET /.env.save HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)" 34.6.13.227
34.6.13.227 - - [27/Oct/2026:03:12:15 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)" 34.6.13.227
34.6.13.227 - - [27/Oct/2026:03:12:15 -0500] "GET /.env.bak HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 34.6.13.227
34.6.13.227 - - [27/Oct/2026:03:12:15 -0500] "GET /.env.example HTTP/1.1" 403 199 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" 34.6.13.227
34.6.13.227 - - [27/Oct/2026:03:12:15 -0500] "GET /.env.old HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.6.13
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-27 08:02:10
(22 hours ago)
{"level":"info","ts":1793088129.4467447,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1793088129.4467447,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.6.13.227","remote_port":"48330","client_ip":"34.6.13.227","proto":"HTTP/2.0","method":"POST","host":"status.whforward.com","uri":"/graphql","headers":{"Accept-Encoding":["gzip, deflate, br, zstd"],"Origin":["https://status.whforward.com"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""],"Sec-Fetch-Site":["same-origin"],"Priority":["u=1, i"],"Sec-Fetch-Dest":["empty"],"Accept":["*/*"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Ch-Ua-Mobile":["?0"],"Referer":["https://status.whforward.com"],"Content-Length":["86"],"Sec-Fetch-Mode":["cors"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Content-Type":["application/json"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.wh
...
show less
DDoS Attack
Web App Attack
2026-10-27 05:54:38
(1 day ago)
Aggressive web scan
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-27 03:20:30
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 34.6.13.227 (227.13.6.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:949110) triggered by 34.6.13.227 (227.13.6.34.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
2026-10-27 00:50:37
(1 day ago)
Attempted access to sensitive endpoint (/.htpasswd) detected. Automated scan or unauthorized probing ...
show more
Attempted access to sensitive endpoint (/.htpasswd) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇳🇱
Alt255
2026-10-26 18:17:59
(1 day ago)
[ti-12al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 34. ...
show more
[ti-12al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 34.6.13.227 - - \[26/Oct/2026:19:17:53 +0100\] "GET /.env.supabase HTTP/2.0" 404 1864 "-" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\; compatible\; ClaudeBot/1.0\; [email protected] \)"
34.6.13.227 - - \[26/Oct/2026:19:17:53 +0100\] "GET /.htpasswd HTTP/2.0" 403 1867 "-" "Mozilla/5.0 \(Linux\; Android 6.0.1\; Nexus 5X Build/MMB29P\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Mobile Safari/537.36 \(compatible\; Googlebot/2.1\; +http://www.google.com/bot.html\)"
...
show less
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-26 18:15:04
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-10-26 05:39:19
(2 days ago)
Multiple WAF Violations
Web App Attack
