|
🇬🇧
andypiper
|
|
CrowdSec ban for AbuseIPDB Top List
|
Brute-Force
Web App Attack
|
|
🇳🇱
Savvii
|
|
20 attempts against mh-misbehave-ban on burne
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇳🇱
homeshowdomain.nl
|
|
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-01.
|
Web App Attack
SSH
Hacking
|
|
🇳🇱
Site.eu
|
|
Scanning for secret files (.env, .git, credentials, config backups)
|
Bad Web Bot
Web App Attack
|
|
🇩🇪
Marc
|
|
34.6.155.223 - - [02/Nov/2026:22:39:52 +0100] "GET /sitemap.xml HTTP/2.0" 404 291 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)" 34.6.155.223 - - [02/Nov/2026:22:39:53 +0100] "GET /sitemap_index.xml HTTP/2.0" 404 292 "-" "Mozi ...
show more
34.6.155.223 - - [02/Nov/2026:22:39:52 +0100] "GET /sitemap.xml HTTP/2.0" 404 291 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)" 34.6.155.223 - - [02/Nov/2026:22:39:53 +0100] "GET /sitemap_index.xml HTTP/2.0" 404 292 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" 34.6.155.223 - - [02/Nov/2026:22:39:53 +0100] "GET /account HTTP/2.0" 404 269 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
show less
|
Brute-Force
|
|
🇪🇸
robotstxt
|
|
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "-" 400 193 "-" "-" "-"
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "-" 400 193 "-" "-" "-"
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "-" 400 193 "-" "-" "-"
34.6.155.223 - - [02/Nov/2026:19:57:52 + ...
show more
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "-" 400 193 "-" "-" "-"
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "-" 400 193 "-" "-" "-"
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "-" 400 193 "-" "-" "-"
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "-" 400 193 "-" "-" "-"
34.6.155.223 - - [02/Nov/2026:19:57:52 +0000] "GET /config.php.bak HTTP/2.0" 400 193 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" "172.23.182.142"
...
show less
|
Web Spam
Web App Attack
|
|
🇩🇪
pscriptos
|
|
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
|
Web App Attack
Hacking
|
|
Anonymous
|
|
Backdrop CMS module - malicious activity detected
|
Bad Web Bot
Web App Attack
|
|
🇪🇸
robotstxt
|
|
34.6.155.223 - - [02/Nov/2026:18:46:35 +0000] "GET /files../.env HTTP/2.0" 403 10035 "-" rt="0.152" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" "192.168.11.15" h="docs. ...
show more
34.6.155.223 - - [02/Nov/2026:18:46:35 +0000] "GET /files../.env HTTP/2.0" 403 10035 "-" rt="0.152" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" "192.168.11.15" h="docs.robotstxt.es" sn="docs.robotstxt.es" ru="/files../.env" u="/index.php" ucs="-" ua="unix:/var/run/php/docs82.sock" us="404" uct="0.000" urt="0.152"
34.6.155.223 - - [02/Nov/2026:18:46:35 +0000] "GET /.env%3Ffoo=bar HTTP/2.0" 403 10035 "-" rt="0.218" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot" "100.87.213.173" h="docs.robotstxt.es" sn="docs.robotstxt.es" ru="/.env%3Ffoo=bar" u="/index.php" ucs="-" ua="unix:/var/run/php/docs82.sock" us="404" uct="0.000" urt="0.219"
34.6.155.223 - - [02/Nov/2026:18:46:35 +0000] "GET /%2eenv HTTP/2.0" 403 10035 "-" rt="0.289" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" "10.106.16
...
show less
|
Web App Attack
|
|
🇩🇪
tsZero
|
|
Scan example: path=/uploads../.env status=403
|
Hacking
|
|
🇩🇪
raph
|
|
[PROTECTED PATHS] crawler credentials.ini, aws.ini, aws.yml, etc.
|
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 34.6.155.223 (223.155.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 19:00:01.096731 2026] [security2:error] [pid 8644:tid 864 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.6.155.223 (223.155.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 19:00:01.096731 2026] [security2:error] [pid 8644:tid 8644] [client 34.6.155.223:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mindmaterial.io"] [uri "/images../.env"] [unique_id "aufSgSjy6lu4tN1NA_TUHQAAAAI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
sternwart
|
|
Automatisch erkannt: Zugriff auf /media../.env (3d.alpasana.ch)
|
Web App Attack
Bad Web Bot
|
|
Anonymous
|
|
Multiple web server 400 error codes from same source ip
|
Web App Attack
|
|
🇳🇱
e.fierstra
|
|
ModSecurity hits exceeded
|
Bad Web Bot
Web App Attack
|