🇳🇱
homeshowdomain.nl
2026-10-02 21:59:52
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-01.
show less
Web App Attack
SSH
Hacking
🇩🇪
Gwyneth Llewelyn
2026-10-02 05:22:55
(3 weeks ago)
2026/10/02 06:22:28 [error] 2513#2513: *142373 access forbidden by rule, client: 34.95.216.147, serv ...
show more
2026/10/02 06:22:28 [error] 2513#2513: *142373 access forbidden by rule, client: 34.95.216.147, server: lisbon-pre-1755-earthquake.org, request: "GET /uploads../.env HTTP/2.0", host: "lisbon-pre-1755-earthquake.org"
2026/10/02 06:22:53 [error] 2513#2513: *142373 access forbidden by rule, client: 34.95.216.147, server: lisbon-pre-1755-earthquake.org, request: "GET /files../.env HTTP/2.0", host: "lisbon-pre-1755-earthquake.org", referrer: "http://lisbon-pre-1755-earthquake.org:8080/files../.env"
2026/10/02 06:22:53 [error] 2513#2513: *142373 access forbidden by rule, client: 34.95.216.147, server: lisbon-pre-1755-earthquake.org, request: "GET /media../.env HTTP/2.0", host: "lisbon-pre-1755-earthquake.org", referrer: "http://lisbon-pre-1755-earthquake.org:8080/media../.env"
show less
Brute-Force
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-10-02 03:53:55
(3 weeks ago)
34.95.216.147 - - [02/Oct/2026:04:53:53 +0100] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1 ...
show more
34.95.216.147 - - [02/Oct/2026:04:53:53 +0100] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 994 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
show less
Bad Web Bot
🇫🇷
mrcrassi
2026-10-02 03:22:26
(3 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from BR.
Action taken: BLOCK
Protocol: HTTP/2 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from BR.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /service-worker.js
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇦🇺
rubixstudios
2026-10-02 02:21:02
(3 weeks ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-10-02 02:05:11
(3 weeks ago)
3.181 requests from abuseipdb.com blacklisted IP (6mos4d15h)
Brute-Force
Bad Web Bot
🇩🇪
BlueWire Hosting
2026-10-02 01:30:48
(3 weeks ago)
Bad bot ignoring robot.txt
Bad Web Bot
2026-10-02 01:29:52
(3 weeks ago)
Aggressive web scan
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-01 20:23:56
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.95.216.147 (147.216.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.216.147 (147.216.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 16:23:51.337507 2026] [security2:error] [pid 13575:tid 13575] [client 34.95.216.147:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webfrog.ws"] [uri "/.env.staging"] [unique_id "ar7BV3DgmPOqdNT08vKTuQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
pscriptos
2026-10-01 18:07:28
(3 weeks ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇫🇮
as211431.net
2026-10-01 18:04:23
(3 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from BR.
Action taken: BLOCK
Protocol: HTTP/2 (GET method) ...
show more
Triggered Cloudflare WAF (firewallCustom) from BR.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /Dockerfile
UA: Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
Gwyneth Llewelyn
2026-10-01 17:00:42
(3 weeks ago)
34.95.216.147 - - [01/Oct/2026:18:00:40 +0100] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1 ...
show more
34.95.216.147 - - [01/Oct/2026:18:00:40 +0100] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 994 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
show less
Bad Web Bot
🇩🇪
Gwyneth Llewelyn
2026-10-01 16:03:47
(3 weeks ago)
2026/10/01 17:03:44 [error] 3532286#3532286: *1991074 access forbidden by rule, client: 34.95.216.14 ...
show more
2026/10/01 17:03:44 [error] 3532286#3532286: *1991074 access forbidden by rule, client: 34.95.216.147, server: [redacted], request: "GET /.//.env HTTP/2.0", host: "wiki.betatechnologies.info"
2026/10/01 17:03:44 [error] 3532286#3532286: *1991041 access forbidden by rule, client: 34.95.216.147, server: [redacted], request: "GET /static//home/user/.env HTTP/2.0", host: "wiki.betatechnologies.info"
2026/10/01 17:03:44 [error] 3532286#3532286: *1991041 access forbidden by rule, client: 34.95.216.147, server: [redacted], request: "GET /static//app/.env HTTP/2.0", host: "wiki.betatechnologies.info"
show less
Brute-Force
Web App Attack
🇪🇸
robotstxt
2026-10-01 15:29:24
(3 weeks ago)
34.95.216.147 - - [01/Oct/2026:15:28:44 +0000] "-" 400 193 "-" "-" "-" edge="34.95.216.147"
34.95.21 ...
show more
34.95.216.147 - - [01/Oct/2026:15:28:44 +0000] "-" 400 193 "-" "-" "-" edge="34.95.216.147"
34.95.216.147 - - [01/Oct/2026:15:28:44 +0000] "GET /storage/logs/laravel.log HTTP/2.0" 400 0 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)" "-" edge="34.95.216.147"
34.95.216.147 - - [01/Oct/2026:15:28:44 +0000] "GET /wp-config.php.bak HTTP/2.0" 400 0 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)" "-" edge="34.95.216.147"
34.95.216.147 - - [01/Oct/2026:15:28:45 +0000] "GET /config.php.bak HTTP/2.0" 400 0 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" "-" edge="34.95.216.147"
34.95.216.147 - - [01/Oct/2026:15:28:45 +0000] "GET /wp-config.php~ HTTP/2.0" 400 0 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" "-" edge="34.95.216.147"
...
show less
Web Spam
Web App Attack
🇩🇪
updown.io
2026-10-01 14:28:38
(3 weeks ago)
{"level":"info","ts":1790864905.260381,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1790864905.260381,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.95.216.147","remote_port":"50600","client_ip":"34.95.216.147","proto":"HTTP/2.0","method":"GET","host":"status.gpltimes.com","uri":"/static/manifest.json","headers":{"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""],"Accept-Encoding":["gzip, deflate, br, zstd"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Priority":["u=0, i"],"Sec-Fetch-Site":["none"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-User":["?1"],"Sec-Fetch-Mode":["navigate"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.3
...
show less
DDoS Attack
Web App Attack
