🇺🇸
technojoe99
2026-10-09 04:17:08
(1 week ago)
Exploit scan from 34.84.78.203. GET /ke4zgspyy28y14vpccc4 HTTP/2.0.
Web App Attack
🇩🇪
Philister11
2026-10-09 00:47:22
(1 week ago)
CrowdSec: crowdsecurity/http-bad-user-agent (JP/AS396982)
Bad Web Bot
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-08 21:10:39
(1 week ago)
2026/10/08 22:10:37 [error] 4060693#4060693: *1304875 access forbidden by rule, client: 34.84.78.203 ...
show more
2026/10/08 22:10:37 [error] 4060693#4060693: *1304875 access forbidden by rule, client: 34.84.78.203, server: api.betatechnologies.info, request: "GET /media../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/08 22:10:37 [error] 4060693#4060693: *1304875 access forbidden by rule, client: 34.84.78.203, server: api.betatechnologies.info, request: "GET /files../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/08 22:10:37 [error] 4060693#4060693: *1304875 access forbidden by rule, client: 34.84.78.203, server: api.betatechnologies.info, request: "GET /js../.env HTTP/2.0", host: "api.betatechnologies.info"
show less
Brute-Force
Web App Attack
🇩🇪
Marc
2026-10-08 20:37:34
(1 week ago)
34.84.78.203 - - [08/Oct/2026:22:37:34 +0200] "GET /backoffice HTTP/2.0" 404 314 "-" "Mozilla/5.0 (W ...
show more
34.84.78.203 - - [08/Oct/2026:22:37:34 +0200] "GET /backoffice HTTP/2.0" 404 314 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" 34.84.78.203 - - [08/Oct/2026:22:37:34 +0200] "GET /secure HTTP/2.0" 404 269 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" 34.84.78.203 - - [08/Oct/2026:22:37:34 +0200] "GET /z9x8c7v6b5-debug-trigger-account.marcrisse.info HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
show less
Brute-Force
2026-10-08 20:34:36
(1 week ago)
34.84.78.203 - - [08/Oct/2026:22:34:36 +0200] "GET /.env HTTP/2.0" 301 169 "-" "Mozilla/5.0 (compati ...
show more
34.84.78.203 - - [08/Oct/2026:22:34:36 +0200] "GET /.env HTTP/2.0" 301 169 "-" "Mozilla/5.0 (compatible; Google-Extended; +http:///)"
show less
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-10-08 20:32:03
(1 week ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-08 20:26:07
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.84.78.203 (203.78.84.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.84.78.203 (203.78.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 16:26:01.320327 2026] [security2:error] [pid 5651:tid 5651] [client 34.84.78.203:42420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "russiacoin.info"] [uri "/.htpasswd"] [unique_id "asf8WZTQIKApvtXZhzioYAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-08 20:20:03
(1 week ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
enpepet
2026-10-08 20:19:51
(1 week ago)
GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.co ...
show more
GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/) URL:/@fs/src/.env?raw??
show less
Port Scan
Hacking
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-08 20:03:44
(1 week ago)
(mod_security) mod_security (id:210580) triggered by 34.84.78.203 (203.78.84.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210580) triggered by 34.84.78.203 (203.78.84.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 16:03:36.966258 2026] [security2:error] [pid 1686:tid 1686] [client 34.84.78.203:37962] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||onlineteacher.info|F|2"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "onlineteacher.info"] [uri "/api/fs/read"] [unique_id "asf3GKRRW_I227ly9PS0eQAAAGI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ger-stg-sifi1
2026-10-08 19:48:32
(1 week ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
hyena
2026-10-08 19:47:47
(1 week ago)
Repeated mod_security events.
Web App Attack
2026-10-08 19:30:04
(1 week ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇫🇷
j-tap
2026-10-08 19:25:29
(1 week ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
🇩🇪
LRob
2026-10-08 19:24:09
(1 week ago)
Wordlist path sweep | method: GET, POST | path: /webpack-stats.json, /x9jjtiqsk7p6s7ipfv1g, /66gnrp9 ...
show more
Wordlist path sweep | method: GET, POST | path: /webpack-stats.json, /x9jjtiqsk7p6s7ipfv1g, /66gnrp902hlybe7wmqxg (+3 more) | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36, DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot), Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] ) (+1 more)
show less
Port Scan
Web App Attack
