🇺🇸
gamabe
2026-10-14 03:09:21
(4 days ago)
Detected crowdsecurity/http-path-traversal-probing attack pattern. Reported by CrowdSec IDS.
Port Scan
🇨🇱
Fernando Soto
2026-10-14 03:05:34
(4 days ago)
WAF propio vps1 (CL): sensMASx195 score 30 en 1h. sondeo rutas sensibles.
Web App Attack
🇫🇮
YF
2026-10-14 03:00:57
(4 days ago)
Distributed subnet attack — coordinated scanning from multiple IPs in the same /24
DDoS Attack
Web App Attack
🇺🇸
grassyloki
2026-10-14 02:25:00
(4 days ago)
Google Cloud GCE host (Taipei) sent ~300+ requests sweeping secret/config files plus LFI path traver ...
show more
Google Cloud GCE host (Taipei) sent ~300+ requests sweeping secret/config files plus LFI path traversal (/userfiles/x?path=../../../../proc/self/environ) and API/graphql endpoints over ~10s; all returned 403/404. User-agents rotated across spoofed crawler names (Googlebot, bingbot, Claude, DeepSe...
Target: HTTP/HTTPS web traffic — secret/config enumeration and LFI path traversal; paths including /.env, /.a host, /.a host::$DATA, /.env?import&raw, /terraform.tfvars, /key.pem, /private-key, /.my.cnf, /...
Seen: 2026-10-13 22:25-22:26 EDT
- 22:25:24 GET /.env?import&raw HTTP/1.1 -> 403 (UA Hunyuan/1.0)
- 22:25:25 GET /.a host HTTP/1.1 -> 403 (UA Bravebot/1.0)
- 22:25:30 GET /.a host::$DATA?raw HTTP/1.1 -> 403 (UA Claude-User/1.0)
- 22:25:30 GET /terraform.tfvars HTTP/1.1 -> 404 (UA DeepSeekBot/1.0)
- 22:25:28 GET /key.pem HTTP/1.1 -> 404 (UA YouBot/1.0)
- 22:25:28 GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1 -> 404 (UA Qwenbot/1.0) LFI traversal
show less
Web App Attack
🇫🇮
as211431.net
2026-10-14 02:11:11
(4 days ago)
Triggered Cloudflare WAF (firewallCustom) from TW.
Action taken: BLOCK
Protocol: HTTP/2 (POST method ...
show more
Triggered Cloudflare WAF (firewallCustom) from TW.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /webhook-test/
UA: Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
kosada.com
2026-10-14 00:33:47
(4 days ago)
Repeated exploit attempts, for example: /graphql {x22queryx22:x22{ __schema { types { name fields { ...
show more
Repeated exploit attempts, for example: /graphql {x22queryx22:x22{ __schema { types { name fields { name args { name defaultValue } } } } }x22} (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36")
show less
Web App Attack
🇧🇪
cmbplf
2026-10-13 23:27:19
(4 days ago)
174 requests with url.path */proc/*
126 requests with url.path *credentials.json
Brute-Force
Bad Web Bot
🇫🇷
sthoyer.de
2026-10-13 21:15:21
(4 days ago)
34.80.206.9 - - [13/Oct/2026:23:15:20 +0200] "GET /auth/login HTTP/2" 302 495 "-" "Mozilla/5.0 (Maci ...
show more
34.80.206.9 - - [13/Oct/2026:23:15:20 +0200] "GET /auth/login HTTP/2" 302 495 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
34.80.206.9 - - [13/Oct/2026:23:15:20 +0200] "GET /z9x8c7v6b5-debug-trigger-metrics.sthoyer.de HTTP/2" 302 495 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
...
show less
Web App Attack
🇺🇸
jormaster3k
2026-10-13 21:12:57
(4 days ago)
Attack against Apache (too many 404s)
Web App Attack
🇺🇸
gamabe
2026-10-13 18:06:42
(4 days ago)
Detected crowdsecurity/http-dos-swithcing-ua attack pattern. Reported by CrowdSec IDS.
Hacking
2026-10-13 17:49:56
(4 days ago)
34.80.206.9 - - [13/Oct/2026:19:49:54 +0200] "GET /dist/manifest.json HTTP/1.1" 404 497 "-" "Mozilla ...
show more
34.80.206.9 - - [13/Oct/2026:19:49:54 +0200] "GET /dist/manifest.json HTTP/1.1" 404 497 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.80.206.9 - - [13/Oct/2026:19:49:54 +0200] "GET /settings/api-keys HTTP/1.1" 404 497 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.80.206.9 - - [13/Oct/2026:19:49:54 +0200] "GET /chat HTTP/1.1" 404 5494 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.80.206.9 - - [13/Oct/2026:19:49:54 +0200] "GET /manifest.json HTTP/1.1" 404 5494 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
34.80.206.9 - - [13/Oct/2026:19:49:54 +0200] "GET /swagger HTTP/1.1" 404 5494 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
...
show less
DDoS Attack
🇺🇸
oralunal
2026-10-13 17:49:22
(4 days ago)
IP banned by Fail2Ban in jail its-suss access.log mvfnds
...
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2026-10-13 15:16:59
(4 days ago)
(PERMBLOCK) 34.80.206.9 (TW/Taiwan/Taipei City/Taipei/9.206.80.34.bc.googleusercontent.com/[redacted ...
show more
(PERMBLOCK) 34.80.206.9 (TW/Taiwan/Taipei City/Taipei/9.206.80.34.bc.googleusercontent.com/[redacted]) has had more than 4 temp blocks
show less
Hacking
🇧🇷
radardatelecom
2026-10-13 14:15:06
(4 days ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇨🇦
zXero
2026-10-13 13:47:49
(4 days ago)
Fail2Ban automatic report - jail: web-exploit
Brute-Force
SSH
DDoS Attack
