🇺🇸
TAY
2026-11-06 19:17:46
UTC ·
(3 days ago)
35.187.238.249 - - [07/Nov/2026:03:17:45 +0800] "GET /appearance/../../proc/self/environ HTTP/1.1" 400 2057 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
35.187.238.249 - - [07/Nov/2026:03:17:45 +0800] " ...
show more
35.187.238.249 - - [07/Nov/2026:03:17:45 +0800] "GET /appearance/../../proc/self/environ HTTP/1.1" 400 2057 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
35.187.238.249 - - [07/Nov/2026:03:17:45 +0800] "GET /appearance/../../.env HTTP/1.1" 400 2057 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
35.187.238.249 - - [07/Nov/2026:03:17:45 +0800] "GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env HTTP/1.1" 404 7876 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
35.187.238.249 - - [07/Nov/2026:03:17:45 +0800] "GET /static/../../../a/../../../../.env HTTP/1.1" 400 2057 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
35.187.238.249 - - [07/Nov/2026:03:17:45 +0800] "GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../pro
...
show less
Brute-Force
🇸🇪
Lemmy
2026-11-06 18:54:56
UTC ·
(3 days ago)
Web App Attack
🇫🇮
as211431.net
2026-11-06 18:44:12
UTC ·
(3 days ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /netlify.toml
UA: Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36
This report was generated by:
htt ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /netlify.toml
UA: Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
igerman
2026-11-06 18:00:14
UTC ·
(3 days ago)
caddy probes: env-probe: GET /.env?import&raw(DROP), GET /.env?import&url&inline(DROP), GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??(DROP), GET /@fs/.env?import&?raw??(DROP), GET /@fs/.env?raw&url??(DROP), GET /@fs/.env?url&raw??(DROP) ...
show more
caddy probes: env-probe: GET /.env?import&raw(DROP), GET /.env?import&url&inline(DROP), GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??(DROP), GET /@fs/.env?import&?raw??(DROP), GET /@fs/.env?raw&url??(DROP), GET /@fs/.env?url&raw??(DROP), GET /@fs/app/.env.production?import&raw??(DROP), GET /@fs/app/.env?import&raw??(DROP), GET /@fs/app/.env?raw??(DROP), GET /@fs/proc/self/cwd/.env?raw??(DROP), GET /@fs/src/.env?import&raw??(DROP), GET /@fs/src/.env?raw??(DROP), GET /@fs/var/task/.env?raw??(DROP), GET /__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc(DROP) | path-traversal: GET /@fs/../.env?import&raw??(DROP), GET /@fs/../.env?raw??(DROP) | web: GET /.bashrc(DROP), GET /.vite/manifest.json(DROP), GET /.zshrc(DROP), GET /@fs/home/ubuntu/.aws/credentials?raw??(DROP)
show less
Web App Attack
2026-11-06 17:13:29
UTC ·
(3 days ago)
Aggressive Robot or Attack DDOS
DDoS Attack
🇧🇷
radardatelecom
2026-11-06 16:54:04
UTC ·
(3 days ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇺🇸
TAY
2026-11-06 15:37:06
UTC ·
(3 days ago)
35.187.238.249 - - [06/Nov/2026:23:37:04 +0800] "GET /wp-config.php.old HTTP/1.1" 200 1113 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com ...
show more
35.187.238.249 - - [06/Nov/2026:23:37:04 +0800] "GET /wp-config.php.old HTTP/1.1" 200 1113 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
35.187.238.249 - - [06/Nov/2026:23:37:05 +0800] "GET /wp-config.php~ HTTP/1.1" 200 1113 "-" "Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.187.238.249 - - [06/Nov/2026:23:37:05 +0800] "GET /wp-config.php.swp HTTP/1.1" 200 1113 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
35.187.238.249 - - [06/Nov/2026:23:37:05 +0800] "GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1" 200 1113 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
35.187.238.249 - - [06/Nov/2026:23:37:04 +0800] "GET /wp-config.php.bak HTTP/1.1" 200 1113 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compa
...
show less
Brute-Force
🇩🇪
rh24
2026-11-06 15:33:01
UTC ·
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 35.187.238.249 (SG/Singapore/249.238.187.35.bc.googleusercontent.com): (CF_ENABLE)
SQL Injection
🇫🇷
masterguru
2026-11-06 15:17:16
UTC ·
(3 days ago)
BAD BOT - Detected and Blocked.. Matched phrase "baidu" at REQUEST_HEADERS:User-Agent. (1100000-131)
Bad Web Bot
🇳🇱
Savvii
2026-11-06 14:57:42
UTC ·
(3 days ago)
15 attempts against mh-modsecurity-ban on byrd
Brute-Force
Web App Attack
🇧🇪
boxed-it
2026-11-06 14:00:03
UTC ·
(3 days ago)
GET /.env.keys (Tarpitted for 11s, wasted 720B)
Web App Attack
🇺🇸
antlac1
2026-11-06 11:59:50
UTC ·
(3 days ago)
CrowdSec detected malicious behaviour (scenario: crowdsecurity/http-bad-user-agent)
Web App Attack
🇧🇪
boxed-it
2026-11-06 11:13:00
UTC ·
(3 days ago)
GET /console (Tarpitted for 11s, wasted 720B)
Web App Attack
2026-11-06 10:44:33
UTC ·
(3 days ago)
Aggressive web scan
Web App Attack
🇩🇪
EGP Abuse Dept
2026-11-06 10:43:48
UTC ·
(3 days ago)
Scanning for web/db/file exploits on www.maritimetravel.nl
SQL Injection
Bad Web Bot
Web App Attack
