🇩🇪
arnisolutions
2026-08-19 12:05:46
(2 weeks ago)
Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production s ...
show more
Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production server. Observed on 6 day(s) between 2026-08-14 and 2026-08-18 (UTC).
show less
Web App Attack
Hacking
🇮🇳
evicky2002
2026-08-14 06:00:12
(2 weeks ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇭🇺
DumaNet
2026-08-10 01:32:00
(3 weeks ago)
Web app attack attempts, scanning for vulnerability.
Date: 2026 Aug 09. 15:01:25
Source IP: 34.6.2 ...
show more
Web app attack attempts, scanning for vulnerability.
Date: 2026 Aug 09. 15:01:25
Source IP: 34.6.235.81
Portion of the log(s):
34.6.235.81 - [09/Aug/2026:15:01:25 +0200] "GET /.env.backup HTTP/1.1" 404 153 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)"
34.6.235.81 - [09/Aug/2026:15:01:25 +0200] "GET /admin/login HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
34.6.235.81 - [09/Aug/2026:15:01:25 +0200] "GET /auth/login HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
34.6.235.81 - [09/Aug/2026:15:01:25 +0200] "GET /admin HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
34.6.235.81 - [09/Aug/2026:15:01:25 +0200] "GET /user/login HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Linux; Android
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-09 12:59:53
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.6.235.81 (81.235.6.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.6.235.81 (81.235.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 09 08:59:47.097665 2026] [security2:error] [pid 1261:tid 1261] [client 34.6.235.81:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "globetechsecurities.com"] [uri "/.env.dev"] [unique_id "anh5w6QV3hFty9Yf86QGmAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-08-09 12:59:17
(3 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇩🇪
maxpower
2026-08-09 12:47:31
(3 weeks ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.6.235.81 (81.235.6.34.bc.googleuserco ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 34.6.235.81 (81.235.6.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 34.6.235.81 - - [09/Aug/2026:14:47:28 +0200] "GET /.aws/credentials HTTP/2.0" 404 10458 "-" "Mozilla/5.0 (compatible; GoogleOther; +http://www.google.com/bot.html)" "34.6.235.81" host=www.marialauracaselli.com
show less
Port Scan
🇭🇳
unph
2026-08-09 12:24:48
(3 weeks ago)
Intento de acceso sospechoso bloqueado por AbuseIPDB Blocker Plugin
Brute-Force
🇩🇪
updown.io
2026-08-09 12:17:11
(3 weeks ago)
{"level":"info","ts":1786277830.33142,"logger":"http.log.access.log0","msg":"handled request","reque ...
show more
{"level":"info","ts":1786277830.33142,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"34.6.235.81","remote_port":"41034","client_ip":"34.6.235.81","proto":"HTTP/2.0","method":"GET","host":"is6l.status.updown.io","uri":"/.gitlab-ci.yml","headers":{"Accept":["*/*"],"Cookie":["REDACTED"],"User-Agent":["Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)"],"Accept-Encoding":["gzip, deflate"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"is6l.status.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000091214,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1786277830.3510585,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"34.6.235.81","remote_port":"41034","client_ip":"34.6.235.81","proto":"HTTP/2.0","method":"POST","host":"is6l.status.updown.io","uri":"/graphql","headers":{"C
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-08-09 11:41:31
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.6.235.81 (81.235.6.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.6.235.81 (81.235.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 09 07:41:25.855655 2026] [security2:error] [pid 343578:tid 343578] [client 34.6.235.81:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||antitribu.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "antitribu.com"] [uri "/z9x8c7v6b5-debug-trigger-antitribu.com"] [unique_id "anhnZbG7PwpnEjZLHSkDVAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
i-turnradio.nl
2026-08-09 11:38:45
(3 weeks ago)
2026-08-09 @ 13:38:44 (CET) ~ Blocked for trying to access: /wp-json
Web App Attack
🇩🇪
MBombeck
2026-08-09 11:15:25
(3 weeks ago)
Fail2Ban/traefik-botsearch on apps-01: banned after 5 failures
Web App Attack
🇺🇸
TPI-Abuse
2026-08-09 11:00:09
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.6.235.81 (81.235.6.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210730) triggered by 34.6.235.81 (81.235.6.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 09 07:00:05.322571 2026] [security2:error] [pid 928117:tid 928117] [client 34.6.235.81:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ipv6.mail-pmg.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ipv6.mail-pmg.com"] [uri "/rclone.conf"] [unique_id "anhdtVvO4k1d0MQVowhBcQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Nightreaver
2026-08-09 10:51:07
(3 weeks ago)
34.6.235.81 - - [09/Aug/2026:12:51:07 0200] "GET /configuration.php.bak HTTP/1.1" 404 5752 "-" "Moz ...
show more
34.6.235.81 - - [09/Aug/2026:12:51:07 0200] "GET /configuration.php.bak HTTP/1.1" 404 5752 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; https://developer.amazon.com/support/amazonbot)"
34.6.235.81 - - [09/Aug/2026:12:51:07 0200] "GET /.env.dev HTTP/1.1" 404 508 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; https://developer.amazon.com/support/amazonbot)"
34.6.235.81 - - [09/Aug/2026:12:51:07 0200] "GET /public/.env HTTP/1.1" 404 5752 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; https://developer.amazon.com/support/amazonbot)"
34.6.235.81 - - [09/Aug/2026:12:51:07 0200] "GET /z9x8c7v6b5-debug-trigger-[snip] HTTP/1.1" 404 508 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; https://developer.amazon.com/support/amazonbot)"
34.6.235.81 - - [09/Aug/2026:12:51:07 0200] "GET /static/manifest.json HTTP/1.1" 404 5752 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36"[...]
show less
Bad Web Bot
Web App Attack
🇩🇪
sigurg
2026-08-09 10:46:21
(3 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇫🇷
dynamix
2026-08-09 10:33:38
(3 weeks ago)
Multiple WAF Violations
Web App Attack