🇳🇱
Site.eu
2026-09-13 18:13:52
(7 minutes ago)
Excessive 404/403 errors
Brute-Force
🇹🇭
thaizone.com
2026-09-13 16:43:16
(1 hour ago)
Hacking attempts against websites (D1) #1
Web App Attack
Hacking
🇩🇪
grassau.com
2026-09-13 12:28:14
(5 hours ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.86.28.158 (US/Uni ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 34.86.28.158 (US/United States/District of Columbia/Washington/158.28.86.34.bc.googleusercontent.com)
show less
Bad Web Bot
🇯🇵
bokumin.org
2026-09-13 10:12:56
(8 hours ago)
[id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [uri "/@fs/root/.env"] [id "94 ...
show more
[id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [uri "/@fs/root/.env"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"]
show less
Web App Attack
🇳🇱
MyGlobalFlowers
2026-09-13 10:05:52
(8 hours ago)
Multiple WAF Violations
Web App Attack
🇬🇧
consul.to
2026-09-13 09:05:12
(9 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
BlueWire Hosting
2026-09-13 08:22:07
(9 hours ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇸🇪
vaia.cloud
2026-09-13 08:05:02
(10 hours ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
Anonymous
2026-09-13 04:26:06
(13 hours ago)
34.86.28.158 - - [13/Sep/2026:01:26:05 -0300] "GET /@fs/app/.env?raw?? HTTP/1.1" 444 0 "-" "Mozilla/ ...
show more
34.86.28.158 - - [13/Sep/2026:01:26:05 -0300] "GET /@fs/app/.env?raw?? HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; TelegramBot/1.0)"
34.86.28.158 - - [13/Sep/2026:01:26:05 -0300] "GET /@fs/root/.env?raw?? HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.8) Gecko/20100101 Firefox/150.8; compatible; TelegramBot/1.0"
34.86.28.158 - - [13/Sep/2026:01:26:05 -0300] "GET /@fs/.env?raw?? HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)"
34.86.28.158 - - [13/Sep/2026:01:26:05 -0300] "GET /@fs/src/.env?raw?? HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/605.1.15 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user) Version/19.0 Safari/605.1.15"
34.86.28.158 - - [13/Sep/2026:01:26:05 -0300] "GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw?? HTTP/1.1" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Twitterbot/1.0)"
...
show less
Port Scan
🇷🇴
iulianh
2026-09-13 04:25:13
(13 hours ago)
80,443
Brute-Force
SSH
Anonymous
2026-09-13 02:43:32
(15 hours ago)
Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence:
/va ...
show more
Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence:
/var/log/nginx/access.log:34.86.28.158 - - [13/Sep/2026:04:43:31 +0200] "GET /api/exec?cmd=%60echo+GSCAN_CMDI%60 HTTP/1.1" 404 11658 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" "-"
/var/log/nginx/access.log:34.86.28.158 - - [13/Sep/2026:04:43:31 +0200] "GET /?ping=%3B+echo+GSCAN_BEGIN%3B+echo+%22%3D%3D%3Did%3D%3D%3D%22%3Bid%3Becho+%22%3D%3D%3Dhost%3D%3D%3D%22%3Bhostname%3Becho+%22%3D%3D%3Dpwd%3D%3D%3D%22%3Bpwd%3Becho+%22%3D%3D%3Dwhoami%3D%3D%3D%22%3Bwhoami+2%3E%2Fdev%2Fnull%3Becho+%22%3D%3D%3Dprintenv%3D%3D%3D%22%3Bprintenv+2%3E%2Fdev%2Fnull%7Chead+-n+200%3Becho+%22%3D%3D%3Denv_secrets%3D%3D%3D%22%3Benv+2%3E%2Fdev%2Fnull%7Cgrep
show less
Bad Web Bot
🇩🇪
sdos.es
2026-09-13 00:25:26
(17 hours ago)
"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"
Web App Attack
🇩🇪
Philister11
2026-09-13 00:00:03
(18 hours ago)
CrowdSec: crowdsecurity/CVE-2022-26134 (US/AS396982)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 22:12:01
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.86.28.158 (158.28.86.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.86.28.158 (158.28.86.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 18:11:57.667171 2026] [security2:error] [pid 30876:tid 30876] [client 34.86.28.158:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.distro.media"] [uri "/@fs/.env"] [unique_id "aqXOLfOq-X1wNTegCH_qNAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-09-12 17:58:56
(1 day ago)
cloudlinux2 fail2ban: 2026-09-12 19:54:24,106 fail2ban.actions [1606]: NOTICE [plesk-modsecu ...
show more
cloudlinux2 fail2ban: 2026-09-12 19:54:24,106 fail2ban.actions [1606]: NOTICE [plesk-modsecurity] Unban 34.18.222.26cloudlinux2 fail2ban: 2026-09-12 19:54:54,974 fail2ban.filter [1606]: INFO [plesk-modsecurity] Found 34.174.75.231 - 2026-09-12 19:54:54cloudlinux2 fail2ban: 2026-09-12 19:54:55,289 fail2ban.filter [1606]: INFO [plesk-modsecurity] Found 34.174.75.231 - 2026-09-12 19:54:55cloudlinux2 fail2ban: 2026-09-12 19:54:55,360 fail2ban.actions [1606]: NOTICE [plesk-modsecurity] Ban 34.174.75.231cloudlinux2 fail2ban: 2026-09-12 19:54:55,146 fail2ban.filter [1606]: INFO [plesk-modsecurity] Found 34.174.75.231 - 2026-09-12 19:54:55cloudlinux2 fail2ban: 2026-09-12 19:54:54,683 fail2ban.filter [1606]: INFO [plesk-modsecurity] Found 34.174.75.231 - 2026-09-12 19:54:54cloudlinux2 fail2ban: 2026-09-12 19:54:55,367 fail2ban.filter [1606]: INFO [recidive] Found 34.174.75.231 - 2026-09-12 19:54:55cloudlinux2 fail2ban: 2026-09-12 19:55:03,490 fail2
show less
Web App Attack