🇧🇷
maviei
2026-09-01 14:32:02
(7 hours ago)
CrowdSec local detection on srv1251771: http-probing. Blocked. AS214943 (NL), 13 events.
Bad Web Bot
Web App Attack
2026-08-31 23:04:43
(22 hours ago)
91.92.241.79 arduino.ua [01/Sep/2026:02:04:43 +0300] "GET /admin/config HTTP/1.1" 404 146 "-" "Mozil ...
show more
91.92.241.79 arduino.ua [01/Sep/2026:02:04:43 +0300] "GET /admin/config HTTP/1.1" 404 146 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/363.0.743255906 Mobile/15E148 Safari/604.1" 0.000 2516
...
show less
Hacking
SQL Injection
Web App Attack
🇪🇸
el-brujo
2026-08-31 17:41:56
(1 day ago)
91.92.241.79 - - [31/Aug/2026:19:41:53 +0200] "GET /config/php.ini HTTP/2.0" 404 4620 "-" "Mozilla/5 ...
show more
91.92.241.79 - - [31/Aug/2026:19:41:53 +0200] "GET /config/php.ini HTTP/2.0" 404 4620 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36"
91.92.241.79 - - [31/Aug/2026:19:41:54 +0200] "GET /admin/config HTTP/2.0" 404 4620 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36"
91.92.241.79 - - [31/Aug/2026:19:41:55 +0200] "GET /test.php HTTP/2.0" 404 4620 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36"
...
show less
DDoS Attack
Hacking
🇩🇪
MusicLibrary
2026-08-31 17:34:53
(1 day ago)
Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)
Bad Web Bot
Web App Attack
🇫🇮
tjs
2026-08-31 11:43:00
(1 day ago)
web attack
Hacking
Web App Attack
🇺🇸
xpto
2026-08-31 11:03:34
(1 day ago)
Blocked for probing for web application vulnerabilities
Web App Attack
🇺🇸
helios.live
2026-08-31 10:47:06
(1 day ago)
2026/08/31 10:47:00 [error] 2959657#2959657: *1723336 FastCGI sent in stderr: "Primary script unknow ...
show more
2026/08/31 10:47:00 [error] 2959657#2959657: *1723336 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 91.92.241.79, server: kocerroxy.com, request: "GET /test.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "app.kocerroxy.com"
91.92.241.79 - - [31/Aug/2026:10:47:00 +0000] "GET /test.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36"
2026/08/31 10:47:05 [error] 2959657#2959657: *1723336 access forbidden by rule, client: 91.92.241.79, server: kocerroxy.com, request: "GET /.aws/credentials HTTP/1.1", host: "app.kocerroxy.com"
91.92.241.79 - - [31/Aug/2026:10:47:05 +0000] "GET /app_dev.php/_profiler/phpinfo HTTP/1.1" 404 1573 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36"
2026/08/31 10:47:06 [error] 2959657#2959657: *1723336 FastCGI
...
show less
Web App Attack
🇺🇸
ANTI SCANNER
2026-08-31 10:20:13
(1 day ago)
Scanner : /admin/config
Web Spam
🇸🇪
vaia.cloud
2026-08-31 08:05:02
(1 day ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇮🇩
Burayot
2026-08-31 05:27:51
(1 day ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 91.92.241.79 (-): 2 in the last 360 ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 91.92.241.79 (-): 2 in the last 3600 secs
show less
Web App Attack
🇮🇩
soc-yk
2026-08-31 00:42:18
(1 day ago)
Type: web_scanning
Risk: 90
Events: 35
Evidence:
- Automated hostile web probing detected
- Repeate ...
show more
Type: web_scanning
Risk: 90
Events: 35
Evidence:
- Automated hostile web probing detected
- Repeated web scanning activity observed
- Threat escalation behavior observed
show less
Web App Attack
2026-08-30 20:42:31
(2 days ago)
RdpGuard detected brute-force attempt on SMTP
Brute-Force
🇺🇸
mnogoweb
2026-08-30 20:42:13
(2 days ago)
(smtpauth) Failed SMTP AUTH login from 91.92.241.79 (NL/The Netherlands/-): 5 in the last 3600 secs; ...
show more
(smtpauth) Failed SMTP AUTH login from 91.92.241.79 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-08-30 14:36:32 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 14:36:33 login authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 14:36:40 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 14:36:40 login authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 14:36:47 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
show less
Port Scan
🇺🇸
mnogoweb
2026-08-30 19:09:55
(2 days ago)
(smtpauth) Failed SMTP AUTH login from 91.92.241.79 (NL/The Netherlands/-): 5 in the last 3600 secs; ...
show more
(smtpauth) Failed SMTP AUTH login from 91.92.241.79 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-08-30 13:09:39 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 13:09:39 login authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 13:09:46 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 13:09:46 login authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 13:09:53 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
show less
Port Scan
🇺🇸
mnogoweb
2026-08-30 17:12:34
(2 days ago)
(smtpauth) Failed SMTP AUTH login from 91.92.241.79 (NL/The Netherlands/-): 5 in the last 3600 secs; ...
show more
(smtpauth) Failed SMTP AUTH login from 91.92.241.79 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-08-30 11:12:17 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 11:12:17 login authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 11:12:25 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 11:12:25 login authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
2026-08-30 11:12:32 plain authenticator failed for ([91.92.241.79]) [91.92.241.79]: 535 Incorrect authentication data ([email protected] )
show less
Port Scan